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PREFACE 


This  report  covers  the  activities  related  to  the  description,  classification  and  analysis  of  the 
types  and  kinds  of  flight  crew  errors,  incidents  and  actions,  as  reported  to  the  Aviation  Safety 
Reporting  System  (ASRS)  database.  These  actions  can  occur  as  a  result  of  the  use  of  Flight 
Management  Systems  (FMS)  to  fly  within  the  National  Airspace  System  (NAS). 

The  material  presented  in  this  report  is  based  on  63  reports  selected  from  the  1989  ASRS 
database  and  36  reports  selected  from  the  1988  ASRS  database.  An  additional  30  reports 
from  the  1988  database  have  been  selected,  however,  they  have  not  been  completely  ana¬ 
lyzed  as  of  this  report.  It  is  intended  that  they  will  be  added  as  an  addendum  to  this  report.  In 
addition,  a  selected  number  of  1990  and  1991  ASRS  reports  may  also  be  included  in  the 
addendum. 

This  report  was  completed  under  the  direction  of  Volpe  National  Transportation  Systems 
Center  (VNTSC)  Program  Manager  M.  Stephen  Hundey,  Jr.  Research  for  the  report  and  its 
preparation  were  conducted  by  Robert  S.  Dodd,  Donald  Eldredge  and  Susan  Mangold,  of 
Battelle,  Columbus,  Ohio. 
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EXECUTIVE  SUMMARY 


This  report  covers  the  activities  related  to  the  description,  classification  and  analysis  of  the 
types  and  kinds  of  flight  crew  errors,  incidents  and  actions,  as  reported  to  the  Aviation  Safety 
Reporting  System  (ASRS)  database.  These  actions  can  occur  as  a  result  of  the  use  of  Flight 
Management  Systems  (FMSs)  to  fly  within  the  National  Airspace  System  (NAS). 

The  Analysis  of  the  ASRS  FMS-related  database  reports  was  conducted  for  the  purpose  of 
determining  the  types  and  kinds  of  design-induced  problems  that  flight  crews  are  having  with 
FMSs  that  can  result  in  the  occurrence  of  errors,  incidents  and  other  operational  problems.  It 
was  believed  that  review  of  these  reports  would  provide  a  useful  background  and  understand¬ 
ing  of  the  FMS  use  domain  (i.e.,  the  flight  environment)  and  offer  a  window  into  the  cockpit 
setting.  This  would  enable  the  identification  of  categories  of  difficulties  that  flight  crews 
appear  to  have  with  the  FMS  and  its  subsystems.  Those  elements  of  the  FMS  operational 
logic  that  are  identified  as  potentially  problematic  will  then  be  investigated  in  more  detail  in 
the  Description  and  Characterization  Study  that  is  also  ongoing.  The  Description  and  Char¬ 
acterization  Study  is  intended  to  provide  a  conceptual  framework  and  methodology  for  the 
analysis  of  the  human-computer  interface  and  operational  logic  embodied  in  current  FMSs. 
The  product  of  that  study  will  be  a  series  of  reports  describing  the  results  of  comparisons 
between  current  FMSs  with  respect  to  procedures  for  performing  common  tasks,  screen  and 
keyboard  layout  and  information  presentation,  and  the  logic  used  to  integrate  individual  FMS 
subsystems  into  a  coherent  system.  These  comparisons  will  serve  as  an  important  basis  for 
attempting  to  assess  relationships  between  the  design  of  FMS  procedures  and  logic,  and  ease 
of  use  from  the  crew's  perspective.  Together,  these  two  documents  will  result  in  a  clearer 
understanding  of  the  design-related  FMS  contributors  to  pilot  error. 

The  review  and  analysis  of  the  ASRS  database  reports  indicates  that  there  does  exist  a  sig¬ 
nificant  number  of  operational  and  design-induced  problems  with  these  systems  that  have 
resulted  in  human/system  performance  errors.  In  most  cases  these  errors  resulted  in  viola¬ 
tions  of  airspace,  either  laterally  or  vertically.  The  most  frequently  reported  result  was  the 
inability  to  meet  altitude  restrictions.  This  was  due  to  either  not  recognizing  or  understanding 
the  current  status  of  the  automation,  or  not  being  able  to  program/re-program  the  FMS  in  a 
timely  and  correct  manner.  This  indicates  that  FMSs  are  not  optimally  designed  from  a 
human-computer  interface  perspective  because  the  procedures  required  to  program  the  FMS, 
[the  screen  information  presented  on  the  Flight  Management  Computer  Control/Display  Unit 
(FMC/CDU),  and  the  organization  of  information],  are  provided  by  other  feedback  sources. 
As  currently  designed,  the  FMS  does  not  "lead"  the  pilot  in  terms  of  the  expected  series  of 
steps  that  must  be  performed  to  accomplish  the  expected  goal  or  end  result.  Furthermore,  the 
placement  of  the  various  information  sources  that  provide  feedback  to  the  pilot,  has  not  been 
optimized,  and  requires  significant  visual  and  cognitive  workload  to  obtain  and  understand 
the  necessary  information. 

The  data  and  crew  observations,  analyzed  and  presented  in  this  report,  have  served  to  point 
out  the  existence  of  certain  design/system  weaknesses  associated  with  the  use  of  this  equip¬ 
ment  by  the  flight  crews.  These  weaknesses  result  in  programming  errors,  airspace  viola- 
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tions,  and  not  being  able  to  effectively  comply  with  ATC  requested  flight  path  changes.  The 
primary  areas  of  concern  are  related  to  the  pilot's  interface  with  the  equipment  itself,  as  well 
as  the  interface  to  the  ATC  system.  The  implementing  of  the  short-term  ATC  clearance 
requirements  require  the  flight  crew  to  progra m/re-program  (or  activate  the  automation 
control  algorithms)  the  FMS  in  a  timely  manner  to  accomplish  the  intended  objective. 

The  implications  from  these  findings  are  that  FMS  designers,  implementors,  and  integrators 
need  to  consider  restructuring  their  FMS  user-machine  interface  software  routines  (including 
individual  screens,  screen  linkage,  navigation  logic,  and  automation  selection/implementa¬ 
tion  logic).  This  will  ensure  that  the  flight  crew’s  ability  to  respond  to  short-term  ATC 
clearances  is  not  overly  impacted  by  FMS-induced  cognitive  demands  at  points  of  high 
workload. 

A  variety  of  tools  and  methodologies,  currently  available  in  the  user-interface  and  cognitive 
engineering  domains,  offer  potentially  valuable  means  for  assessing  the  usability  of  various 
aspects  of  the  FMS.  Tools  such  as  the  GOMS  Model  Methodology,  Modified  Petri  Nets,  and 
Operational  Sequence  Diagrams,  when  applied  to  the  FMS  logic  and  structure,  can  provide  a 
useful  framework  for  analyzing  the  common  features  and  procedures  across  the  various 
FMSs.  These  analysis  can  result  in  the  development  of  recommendations  for  the  design/re¬ 
design  of  standardized  interfaces,  procedures,  and  placement  of  critical  information.  In 
addition,  the  use  of  such  tools  may  also  point  out  the  need  for  specific  training  materials  and 
curriculum  that  will  ensure  the  proper  usage  of  the  FMS  equipment  by  the  flight  crews. 

The  material  in  this  report  was  developed  using  data  from  NASA’s  Aviation  Safety  Reporting 
System  database.  The  reports  in  the  database  have  been  voluntarily  submitted,  primarily  by 
flight  crew  members  or  other  participants  in  the  Aviation  System  and,  as  such,  they  reflect 
certain  reporting  biases.  These  data  and  materials  may  not  be  entirely  representative  of  types 
and  number  of  occurrences  that  actually  occur,  consequently,  the  application  of  statistical 
tools  to  these  data  should  be  treated  with  care.  However,  the  reports  provide  an  excellent 
source  of  qualitative  information  and,  as  such,  offer  a  useful  picture  of  the  nature  and  types 
of  problems  that  are  occurring  as  a  result  of  using  FMSs  in  the  flight  environment. 
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1.  SUMMARY 


This  report  documents  a  portion  of  the  work  accomplished  under  DOT/VNTSC  contract 
DTRS-57-89-D00086  (RA  0008),  Work  Order  #2,  entitled  “Flight  Management  System 
Description/Characterization,”  during  the  period  October,  1990  to  July,  1991. 

1.1  Scope 

This  report  covers  the  activities  related  to  the  description,  classification  and  analysis  of  the 
types  and  kinds  of  flight  crew  errors,  incidents  and  actions,  as  reported  to  the  Aviation  Safety 
Reporting  System  (ASRS)  database.  These  actions  can  occur  as  a  result  of  the  use  of  Right 
Management  Systems  (FMSs)  to  fly  within  the  National  Airspace  System  (NAS). 

1.2  Purpose 

The  analysis  of  the  ASRS  FMS-related  database  reports  was  conducted  for  the  purpose  of 
determining  the  types  and  kinds  of  design-induced  problems  that  flight  crews  are  having  with 
FMSs  that  can  result  in  the  occurrence  of  errors,  incidents  and  other  operational  problems.  It 
was  believed  that  review  of  these  reports  would  provide  a  useful  background  and  understand¬ 
ing  of  the  FMS  use  domain  (i.e.,  the  flight  environment)  and  offer  a  window  into  the  cockpit 
setting.  This  would  enable  the  identification  of  categories  of  difficulties  that  flight  crews 
appear  to  have  with  the  FMS  and  its  subsystems.  Those  elements  of  the  FMS  operational 
logic  that  are  identified  as  potentially  problematic  will  then  be  investigated  in  more  detail  in 
the  Description  and  Characterization  Study  that  is  also  ongoing.  The  Description  and  Char¬ 
acterization  Study  is  intended  to  provide  a  conceptual  framework  and  methodology  for  the 
analysis  of  the  human-computer  interface  and  operational  logic  embodied  in  current  FMSs. 
The  product  of  that  study  will  be  a  series  of  reports  describing  the  results  of  comparisons 
between  current  FMSs  with  respect  to  procedures  for  performing  common  tasks,  screen  and 
keyboard  layout  and  information  presentation,  and  the  logic  used  to  integrate  individual  FMS 
subsystems  into  a  coherent  system.  These  comparisons  will  serve  as  an  important  basis  for 
attempting  to  assess  relationships  between  the  design  of  FMS  procedures  and  logic,  and  ease 
of  use  from  the  crew's  perspective.  Together,  the  products  from  the  ASRS  Database  Study 
and  the  Description  and  Characterization  Study  will  contribute  to  a  clearer  understanding  of 
the  design-related  FMS  contributors  to  pilot  error. 

1.3  Results 

The  review  and  analysis  of  the  ASRS  database  reports  indicates  that  there  does  exist  a  sig¬ 
nificant  number  of  operational  and  design-induced  problems  with  these  systems  that  have 
resulted  in  human/system  performance  errors.  In  most  cases,  these  errors  resulted  in  vio¬ 
lations  of  airspace,  either  laterally  or  vertically.  The  most  frequently  reported  result  was  the 
inability  to  meet  altitude  restrictions.  This  was  due  to  either  not  recognizing  or  understanding 
the  current  status  of  the  automation,  or  not  being  able  to  program/re-program  the  FMS  in  a 
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timely  and  correct  manner.  This  indicates  that  FMSs  are  not  optimally  designed  from  a 
human-computer  interface  perspective  because  the  procedures  required  to  program  the  FMS, 
[the  screen  information  presented  on  the  Flight  Management  Computer  Control/Display  Unit 
(FMC/CDU),  and  the  organization  of  information],  are  provided  by  other  feedback  sources. 
As  currently  designed,  the  FMS  does  not  “lead”  the  pilot  in  terms  of  the  expected  series  of 
steps  that  must  be  performed  to  accomplish  the  expected  goal  or  end  result.  Furthermore,  the 
placement  of  the  various  information  sources  that  provide  feedback  to  the  pilot,  has  not  been 
optimized,  and  requires  significant  visual  and  cognitive  workload  to  obtain  and  understand 
the  necessary  information. 


1 .4  Work  In  Progress 

The  material  presented  in  this  report  is  based  on  63  reports  selected  from  the  1989  ASRS 
database  and  36  reports  selected  from  the  1988  ASRS  database.  An  additional  30  reports 
from  the  1988  database  have  been  selected,  however,  they  have  not  been  completely  ana¬ 
lyzed  as  of  this  report.  It  is  intended  that  they  will  be  added  as  an  addendum  to  this  report.  In 
addition,  a  selected  number  of  1990  and  1991  ASRS  reports  may  also  be  included  in  the 
addendum. 


1.5  Conclusions 

The  reports  contained  in  the  ASRS  database  provide  an  excellent  source  for  ascertaining  the 
nature  and  scope  of  the  problems  that  flight  crews  are  currently  experiencing  in  using  the 
FMS  to  control  their  flight  path  (both  laterally  and  vertically)  under  normal  flight  conditions. 
The  information  contained  in  this  database  is  unique  in  that  it  provides  a  “snapshot,”  from  the 
pilot’s  perspective,  of  the  types  and  kinds  of  problems/errors  that  are  being  experienced  in 
attempting  to  use  the  high  levels  of  automation  that  characterize  today’s  modem  transport 
aircraft  cockpit. 

The  data  and  crew  observations,  analyzed  and  presented  in  this  report,  have  served  to  point 
out  the  existence  of  certain  design/system  weaknesses  associated  with  the  use  of  this  equip¬ 
ment  by  the  flight  crews.  These  weaknesses  result  in  programming  errors,  airspace  viola¬ 
tions,  and  not  being  able  to  effectively  comply  with  *\TC  requested  flight  path  changes.  The 
primary  areas  of  concern  are  related  to  the  pilot’s  interface  with  the  equipment  itself,  as  well 
as  the  interface  to  the  ATC  system.  The  implementing  of  the  short-term  ATC  clearance 
requirements  require  the  flight  crew  to  program/re-program  (or  activate  the  automation 
control  algorithms)  the  FMS  in  a  timely  manner  to  accomplish  the  intended  objective. 

The  implications  from  these  findings  are  that  FMS  designers,  implementors,  and  integrators 
need  to  consider  restructuring  their  FMS  user-machine  interface  software  routines  (including 
individual  screens,  screen  linkage,  navigation  logic,  and  automation  selection/implementa¬ 
tion  logic).  This  will  ensure  that  the  flight  crew’s  ability  to  respond  to  short-term  ATC 
clearances  is  not  overly  impacted  by  FMS-induced  cognitive  demands  at  points  of  high 
workload. 
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The  issues  raised  in  this  study  suggest  the  need  to  conduct  further  studies  that  will  result  in 
the  critical  description  and  characterization  of  the  current  pilot/automation  interface,  in  order 
to: 

•  Ensure  that  the  both  the  retrofit  and  next  generation  of  FMS  equipment  rectify  the 
current  design  problems  that  are  contributing  to  the  occurrence  of  pilot  error, 

•  Ensure  that  information  presentation  is  accurate  and  understandable  in  terms  of  what 
the  automation  is  doing,  or  is  expected  to  do;  and 

•  Satisfy  the  flight  crew’s  needs  to  be  able  to  implement  short-term  modifications  to  the 
flight  plan  in  an  efficient,  safe,  and  predictable  way,  through  the  introduction  of 
improved  V  NAV  algorithms  and  more  exact  control  of  the  automation  parameters. 

In  order  to  accomplish  the  objectives  of  the  overall  description  and  characterization  task,  the 
problems  identified  above,  as  well  as  other  less  critical  (but  perhaps  contributing)  factors, 
need  to  be  examined  and  evaluated  in  terms  of  the  usage  of  common  features  shared  by  all 
FMSs,  including: 

•  Navigational  tools  such  as  mode  select  and  line  select  keys; 

•  The  mode  control  panel  interface  logic  as  it  is  used  to  control  level  of  automation 
(flight  director,  autopilot,  V  NAV/L  NAV); 

•  Screen  information  content  and  placement; 

•  Information  feedback  display  content  and  placement; 

•  Potential  alternative  keying  logics. 

A  variety  of  tools  and  methodologies,  currently  available  in  the  user-interface  and  cognitive 
engineering  domains,  offer  potentially  valuable  means  for  assessing  the  usability  of  various 
aspects  of  the  FMS.  Tools  such  as  the  GOMS  Model  Methodology,  Modified  Petri  Nets,  and 
Operational  Sequence  Diagrams,  when  applied  to  the  FMS  logic  and  structure,  can  provide  a 
useful  framework  for  analyzing  the  common  features  and  procedures  across  the  various 
FMSs.  These  analysis  can  result  in  the  development  of  recommendations  for  the  design/re¬ 
design  of  standardized  interfaces,  procedures,  and  placement  of  critical  information.  In 
addition,  the  use  of  such  tools  may  also  point  out  the  need  for  specific  training  materials  and 
curriculum  that  will  ensure  the  proper  usage  of  the  FMS  equipment  by  the  flight  crews. 

1.6  Limitations 

The  material  in  this  report  was  developed  using  data  from  NASA’s  Aviation  Safety  Report¬ 
ing  System  database.  The  reports  in  the  database  have  been  voluntarily  submitted,  primarily 
by  flight  crew  members  or  other  participants  in  the  Aviation  System  and,  as  such,  they  reflect 
certain  reporting  biases.  These  data  and  materials  may  not  be  entirely  representative  of  types 
and  number  of  occurrences  that  actually  occur.  Consequently,  the  application  of  statistical 
tools  to  these  data  should  be  treated  with  care.  However,  the  reports  provide  an  excellent 
source  of  qualitative  information  and,  as  such,  offer  a  useful  picture  of  the  nature  and  types 
of  problems  that  are  occurring  as  a  result  of  using  FMSs  in  the  flight  environment. 
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2.  INTRODUCTION 


Flight  Management  Systems  (FMSs)  play  a  critical  role  in  the  performance  of  a  number  of 
flight  tasks,  including  navigation  and  maintenance  of  desired  aircraft  position,  attitude,  and 
orientation;  and  aircraft  performance  optimization.  FMSs  are  highly  integrated  systems, 
consisting  of  a  number  of  subsystems  including  Flight  Management  Computers  (FMC’s),  the 
FMC  Control/Display  Unit  (CDU),  the  mode  control  panel  (MCP),  the  Autothrottle  System, 
the  Attitude  Director  Indicator,  and  the  Software  Database.  Because  they  are  currently  being 
designed  and  built  by  a  host  of  manufacturers,  it  is  likely  that  FMSs  differ  with  regard  to  the 
automation  philosophy  driving  the  operation  of  their  functions,  the  architecture  and  logic  of 
their  software,  and  the  rules  and  procedures  required  to  operate  the  system. 

From  the  perspective  of  the  flight  crew,  differences  in  the  rules  and  procedures  for  using  the 
system,  together  with  variations  in  system  responses  to  crew  actions,  are,  of  course,  the 
primary  concern.  Under  normal  conditions,  such  differences  are  simply  a  nuisance.  Under 
time  critical  conditions,  these  differences  can  impact  the  flight  crew’s  ability  to  respond 
effectively,  especially  when  they  increase  the  complexity  of  the  task,  inhibit  the  flight  crew’s 
ability  to  utilize  the  capabilities  of  the  FMS,  and  consequently,  increase  the  flight  crew’s 
workload. 

At  the  present  time,  feedback  concerning  operational  complexities  and  problems  associated 
with  the  use  of  FMSs  is  not  generally  reported,  except  when  an  incident  occurs  that  results  in 
the  submission  of  a  report  to  the  ASRS.  The  purpose  of  this  report  is  to  extract  basic  FMS- 
related  knowledge  from  the  ASRS  reports,  and  then  to  make  assessments  concerning  the 
underlying  causes  of  the  reported  problems.  This  knowledge  can  then  be  used  as  critical 
guidance  for  identifying  those  aspects  of  FMS  use  that  appear  to  cause  the  greatest  difficulty 
for  the  flight  crew.  Problem  areas  can  then  be  analyzed  in  greater  detail,  by  means  of  a 
description/characterization  analysis  of  current  FMSs,  in  order  to  better  identify  the  un¬ 
derlying  design  or  procedural  issues  that  may  have  contributed  to  the  occurrence  of  reported 
incidents.  In  addition,  by  comparing  the  logic  and  procedures  of  current  FMSs,  it  may  be 
possible  to  specify  those  approaches,  actually  in  use,  that  are  more  likely  to  encourage  the 
occurrence  of  flight  crew  problems. 
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3.  APPROACH 


A  total  of  282  FMS -related  reports,  describing  incidents  reported  to  ASRS  that  occurred 
during  1988  and  1989,  were  retrieved  from  the  ASRS  database  using  FMS-related  search 
terms.  From  these  282  reports,  129  reports  were  selected  on  the  basis  of  the  reported  incident 
having  arisen,  at  least  in  part,  because  of  crew  problems  with  the  FMS.  To  this  point,  99  of 
these  reports  have  been  reviewed  in  detail,  and  this  report  represents  the  analysis  of  those 
reports. 

Certain  statistical  qualifications  must  be  remembered  when  ASRS  data  are  used.  All  ASRS 
data,  including  those  used  in  this  study,  are  submitted  voluntarily  by  the  reporter  and  may 
reflect  reporting  biases;  as  such,  they  constitute  a  non-random  sample  population  of  aviation 
incidents  and  events.  Further,  the  reports  used  in  this  study  have  been  selected  because  the 
reporter  clearly  described  some  type  of  connection  to  FMS  use.  It  is  possible  that  some 
reported  incidents  that  were  excluded  from  study  did,  in  fact,  include  a  contributing  role  of 
the  FMS  but  failed  to  be  included  in  the  analyzed  sample.  Consequently,  the  reports  cited  in 
this  study  should  not  be  considered  a  random  sample  of  all  FMS-related  incident  reports  in 
the  ASRS  database. 

The  reports  in  this  sample  were  reviewed  and  evaluated  using  12  incident  descriptive  cate¬ 
gories  associated  with  FMS-related  incidents  that  were  developed  through  the  initial  eval¬ 
uation  of  over  300  ASRS  reports  gathered  from  the  years  1986  through  1989.  These  cate¬ 
gories  were  identified  based  upon  an  extensive  review  of  the  ASRS  reports  and  other  FMS- 
related  technical  literature,  and  are  considered  to  be  descriptive  of  the  types  of  problems  that 
are  encountered  by  the  flight  crews  as  they  interface  with  the  various  elements  of  the  FMS. 
These  categories  are  listed  in  Table  3-1. 


Table  3-1.  FMS  Incident  Descriptive  Categories 


1)  Keyboard  errors  made  by  flight  crew  in  inputting  data 

2)  Logic  errors  made  by  flight  crew  in  inputting  data 

3)  System  performance  errors  -  attributed  to  hardware  errors/failures 

4)  System  performance  errors  -  attributed  to  software  mistakes/design  problems 

5)  Errors  of  expectation/interpretation  by  the  flight  crew  -  ATC  logic  related 

6)  Errors  of  expectation/interpretation  by  the  flight  crew  -  FMS  logic  related 

7)  Errors  due  to  ATC/crew  high  workload  -  above  10,000  ft. 

8)  Errors  due  to  ATC/crew  high  workload  -  below  10,000  ft. 

9)  Mode  control  panel  (MCP)/automation  control  selection  errors  made  by  flight 
crew 

10)  FMS/MCP  interaction  errors 

1 1 )  Errors  related  to  pre- stored  database/company  routes 

1 2)  Training/flight  crew  proficiency  related  errors/performance  problems 
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These  incident  descriptive  categories  are  not  mutually  exclusive  in  that  the  same  incident  can 
fit  into  more  than  one  category.  Also,  they  reflect  a  first  attempt  at  a  classification  scheme 
and  are  clearly  operational  in  nature.  The  decision  was  made  to  use  an  operational  classifica¬ 
tion  scheme  in  the  preliminary  phase  of  the  analysis  in  order  to  avoid  bias  that  can  arise 
through  inferring  beyond  what  is  said  in  the  report  itself.  Because  incident  reporters  rarely 
base  their  explanations  of  what  happened  on  human  factors/cognitive  causes  (two  exceptions 
being  “high  workload”  and  “distraction”),  a  categorization  scheme  organized  around  human 
factors/cognitive  factors  would  necessarily  involve  inference  on  the  part  of  the  report  ana¬ 
lysts.  Because  of  the  preliminary  stage  in  which  these  analyses  have  been  performed,  it  was 
felt  that  analyses  based  on  inference  are  premature.  However,  it  was  quickly  discovered  that 
an  operational  categorization  scheme  failed  to  encompass  what  the  authors  came  to  believe 
was  “really  going  on.”  Consequently,  the  operational  categorization  scheme  has  been 
supplemented  by  a  set  of  more  general  “problems”  categories  that  attempt  to  describe  causes 
of  errors  that  go  beyond  the  purely  operational.  These  categories  begin  to  get  at  the  more 
human  factors/cognitive  types  of  error  causes  but  are  probably  best  described  as  operating  at 
the  level  of  pilot  explanations  of  problems. 

[Note:  Technically,  the  terms  “FMS”  and  “FMC”  can  both  be  used  to  refer  to  that  pan  of  the 
FMS  used  to  control  V  NA  V  and  L  NAV.  For  the  purposes  of  this  paper,  however,  the  term 
“FMS”  is  used  to  refer  to  the  Flight  Management  System  as  a  whole,  including  the  autopilot, 
flight  director,  and  Flight  Management  Computer.  “FMC”  is  used  specifically  to  refer  to  the 
subsystem  that  controls  V  NAV  and  L  NAV,  that  is,  the  coupling  of  the  FMC  with  the 
autopilot,  with  the  FMC/CDU  as  the  crew’s  interface  to  this  subsystem.] 
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4.  FINDINGS 


In  this  section,  the  findings  based  on  the  review  of  the  99  selected  reports  are  described. 
Incidents  fall  into  two  main  categories:  Those  that  arose  because  of  crew  error  and  those  that 
appear  to  be  due  to  hardware  or  software  malfunctioning.  Flight  crew-related  errors  are 
discussed  in  Section  4.1  with  haidwarc/software  errors  presented  in  Section  4.2. 

4.1  Crew-Related  Errors 

In  this  section,  crew-Telated  errors  are  addressed  from  two  perspectives.  Section  4.1.1  sum¬ 
marizes  the  data  concerning  types  of  crew  errors  and  the  conditions  under  which  these  errors 
tend  to  occur.  Section  4.1.2  offers  a  more  qualitative  approach  to  the  ASRS  reports  and 
describes  some  possible  contributing  causes  for  the  occurrence  of  these  incidents. 

4.1.1  Descriptive  Summaries 

This  section  of  the  report  presents  summaries  of  the  data  that  pertain  to  three  analyses: 

•  Number  of  incidents  for  each  type  of  crew  error; 

•  Number  of  incidents  thought  to  be  caused,  at  least  in  part,  by  either  high  workload  or 
insufficient  training; 

•  Number  of  incidents  as  a  function  of  phase  of  flight. 

4. 1.1.1  Types  and  Frequency  of  Crew  A  ction-Based  Errors 

Table  4-1  presents  a  descriptive  summary  of  the  number  of  incidents  that  were  based,  at  least 
in  part,  on  actions  (or  lack  of  action)  on  the  part  of  the  crew.  These  errors  often  arose  be¬ 
cause  of  the  flight  crews’  expectation  that  the  FMS  would  perform  in  a  particular  way,  for  a 
given  set  of  commands  or  selected  operations.  When  it  did  not  perform  as  expected,  the  crew 
often  expressed  surprise  at  the  end  result. 

The  Incident  Description  Categories,  used  in  Table  4-1,  are  defined  as  follows: 

•  Keyboard  errors  made  while  inputting  data  usually  involved  a  straightforward  error  of 
inputting  information  that  was  wrong,  such  as  an  incorrect  navigation  fix  or 
mis-keying  the  data  during  entry  and  not  catching  it  before  execution. 

•  Logic  errors  usually  involved  the  flight  crew  entering  data  in  a  format  or  form  that  the 
FMC  would  not  recognize,  or  the  pilot  not  understanding  the  underlying  limitations 
of  the  system  when  he  or  she  tried  to  enter  the  data. 

•  Errors  of  expectation/interpretation  that  were  ATC-related  dealt  primarily  with  errors 
in  the  crew’s  understanding  of  how  the  FMS  would  respond  to  modifications  that 
affect  the  aircraft’s  vertical  or  lateral  path.  This  class  of  errors  is  referred  to  as  ATC- 
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related  because  these  modifications  are  typically  made  in  response  to  ATC  clear¬ 
ances. 

•  Errors  of  expectation/interpretation  that  were  related  to  the  FMS  logic  involve  crew 
misunderstanding  of  the  FMS  itself,  that  is,  how  the  various  subsystems  that  comprise 
the  FMS  can  be  used  and  modified. 

•  Mode  control  panel/automation  control  selection  errors  involved  incorrect  selection 
or  modification  of  an  automation  level  by  means  of  the  mode  control  panel. 

The  data  presented  in  Table  4-1  suggest  the  same  underlying  problem:  The  crew  fails  to 
operate  the  FMS  properly  and,  at  the  same  time,  fails  to  catch  the  error  before  an  incident 
occurs.  The  following  example  demonstrates  this  pattern  in  a  case  where  the  flight  crew 
received  a  multiple  clearance  from  ATC  and  became  confused  when  they  tried  to  re-program 
the  FMC/CDU. 

(1 30700) 1  “We  were  assigned  a  heading,  altitude  and  airspeed  change  (by  ATC) 
all  at  once.  The  first  officer  was  flying,  the  aircraft  was  on  autopilot  and  the  FMS 
was  controlling  the  autopilot.  We  were  assigned  250  knots  at  7,000  feet.  They 
slowed  us  to  210  knots  and  the  first  officer  entered  the  command  in  the  FMS.  A 
couple  of  minutes  later,  ATC  slowed  us  again  to  170  knots.  The  confusion  occurred 
when  we  saw  the  aircraft  was  still  doing  nearly  250  knots!  It  had  not  slowed  down. 
We  entered  the  altitude  change,  began  descending,  and  were  playing  ‘What’s  it  doing 
now?’  game  to  determine  why  it  hadn’t  slowed  as  commanded.  . .  .Time  lost  trying  to 
decide  what  it’s  up  to  put  us  behind  the  aircraft.” 

These  data  appear  to  argue  for  the  need  for  the  crew  to  continuously  monitor  and  pay  atten¬ 
tion  to  the  FMS,  even  when  the  FMS  is  in  a  fully  automated  mode  and  has  apparently  ac¬ 
cepted  the  flight  crew  command  inputs.  The  simplicity  of  this  statement,  however,  is  ques¬ 
tionable  and  will  be  reviewed  in  the  Section  4.1.2. 

Table  4-1.  Flight  Crew  FMS  Actions/Errors 


Category  Incident  Description 

Citations 

1 

Keyboard  errors  made  by  flight  crew  in  inputting  data 

15 

2 

Logic  errors  made  by  flight  crew  in  inputting  data 

3 

5 

Errors  of  expectation/interpretation  by  the  flight  crew  - 
ATC  related 

12 

6 

Errors  of  expectation/interpretation  by  the  flight  crew  - 
FMS  logic  related 

27 

9 

Mode  control  panel  (MCP)/automation  control  selection 
errors  made  by  flight  crew 

18 
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4. 1.1. 2  Temporal  Contributors  to  Crew-Based  Errors 


Two  major  factors,  of  a  temporal  nature,  that  contribute  to  success  in  using  the  FMS  are: 

•  preparedness  of  the  flight  crew  to  interface  with  the  FMS  and  make  the  necessary 
actions  required  to  use  the  system,  (i.e.  training) 

•  conditions  during  the  flight  that  contribute  to  the  crew’s  ability  to  use  the  FMS  (i.e. 
workload) 

The  data  in  Table  4-2  summarize  the  information  from  the  ASRS  reports  in  which  the  flight 
crew  indicated  that  a  high  workload  element  or  flight  crew  training  element  contributed  to,  or 
was  involved  in,  the  incident.  Workload  was  only  included  in  this  table  if  it  was  directly 
cited  by  the  reporter,  or  it  was  clear  that  the  pilots  or  ATC  were  unusually  busy.  Those 
citations  for  workload  above  10,000  feet  usually  occurred  in  the  middle  altitudes  below  the 
flight  level  altitudes.  The  pilots’  inability  to  deal  with  the  FMS  was  often  attributed  to  a  high 
workload  level,  either  from  ATC  or  weather,  which  did  not  allow  them  time  to  concentrate 
on  FMS  programming  or  trouble  shooting. 

High  workload  errors  for  ATC  and  flight  crews  relating  to  FMS  errors  were  stratified  -  above 
and  below  10,000  feet  -  to  gain  some  insight  on  workload  patterns.  10,000  feet  was  selected 
as  a  cut-off  since,  technically,  the  highest  level  of  automation,  which  involves  using  the 
FMC)  is  not  supposed  to  be  modified  below  10,000  feet.  If  modifications  are  required,  the 
crew  are  supposed  to  use  a  different  automation  level,  such  as  flight  director  or  autopilot.  It 
is  interesting  to  note  that  at  least  six  crews  chose  to  ignore  this  policy  and  attempted  to  use 
the  FMC  automation. 

Of  greater  interest  is  the  comparison  between  workload  above  10,000  feet  and  insufficient 
training  as  a  contributing  factor  to  the  occurrence  of  the  incident.  Training  and  flight  crew 
proficiency  related  error  were  only  cited  if  it  was  clear,  from  the  reports,  that  they  could  be 
considered  contributing  factors  to  the  event  occurrence. 

Based  upon  the  data  in  this  table,  insufficient  training  and  workload  are  equally  likely  to  be 
cited  as  a  contributor.  This  suggests  that  crews  find  that  the  automation  does  not  help  in 


Table  4-2.  Associated  Incident  Events  and  Precursors 


Category  Incident  Description 


Citations 


7  Errors  due  to  ATC/crew  high  workload-above  10,000  ft  1 1 

8  Errors  due  to  ATC/crew  high  workload- below  10,000  ft.  6 

1 2  Training/flight  crew  proficiency  related  errors/performance  1 2 

problems. 


Table  4-3.  Phase  of  Flight 


Phase  of  Flight 

Citations 

Climb 

21 

SID 

6 

Enroute 

14 

Transition 

2 

Crossing  Restriction 

40 

Descent 

10 

STAR 

4 

Approach 

2 

Holding  Pattern 

6 

reducing  workload  and  the  system  itself  requires  considerable  experience  to  be  effectively 
used. 


4.1.13  Phase  of  Flight 

The  data  in  Table  4-3  describe  the  reported  point,  in  the  progress  of  a  flight,  that  the  FMS 
error  was  discovered  and/or  the  incident  occurred.  It  does  not  necessarily  represent  the  point 
where  the  initial  error  occurred.  For  example,  an  erroneous  holding  pattern  being  included  in 
the  navigation  database  provided  with  the  FMS,  is  an  error  which  likely  occurred  before  the 
airplane  was  first  flown,  by  this  crew,  and  on  this  route.  The  error  may  only  be  discovered 
some  time  later  when  the  flight  crew  performs  the  operations  necessary  to  implement  the 
ATC  instructions  and  fly  that  particular  holding  pattern. 

This  table,  however,  does  provide  some  insight  as  to  where  these  flight  crews  experienced 
their  difficulties.  Of  particular  note  is  the  significant  percentage  (72%)2  of  the  reports  in¬ 
volving  altitude  changes  (climb,  descent,  and  crossing  restrictions).  The  vertical  navigation 
operation  of  the  FMSs,  and/or  the  flight  crew’s  understanding  of  this  capability,  is  certainly 
an  area  that  deserves  closer  attention  in  terms  of  potential  re-design. 

4. 1 .2  “Problems”  Categories 

Reading  the  actual  incident  reports  suggests  that  the  types  of  statistics  just  described  do  not 
give  a  complete  picture  of  contributors  to,  and  causes,  of  crew  errors.  There  appear  to  be 
difficulties  faced  by  the  crew  that  are  not  reflected  in  these  statistics.  Based  on  the  reports, 
these  problems  appear  to  fall  into  eight  basic  categories: 

1 .  Raw  Data  and  FMS/ Aircraft  Status  Verification 

2.  FMS  Algorithmic  “Behavior” 
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3.  Improper  Use  of  the  FMC  Automation  Level 

4.  FMC  Programming  Demands 

5.  Multiple  FMC  Page  Monitoring  Requirements 

6.  Complex  ATC  Clearances 

7.  Complex  FMC/CDU  Tasks 

8.  Lack  of  Adequate  Pilot  Training 

These  problem  areas  are  described  below. 

4.12.1  Raw  Data  and  FMSlAircraft  Status  Verification 

A  common  observation  by  the  majority  of  the  pilots  submitting  these  reports  was  the  belief 
that  they  did  not  have  enough  information  about  what  the  FMS  was  doing  to  be  able  to 
effectively  monitor  the  system.  This  was  particularly  problematic  when  the  pilots  were  very 
busy  and  could  not  spend  the  extra  time  needed  to  focus  on  the  FMS  and/or  the  aircraft. 
Essentially,  once  they  enter  data  or  commands  into  the  system,  they  must  assume  any  or  all 
of  the  following: 

•  That  the  data  entered  is  correct; 

•  That  the  intended  operation  will  be  executed  correctly,  and, 

•  That  it  will  be  executed  at  the  proper  time. 

There  is  usually  no  easy  method  for  pilots  to  monitor  the  system’s  progress  or  to  know  if  the 
data/commands  they  entered  will  work  as  planned  until  the  action  or  error  occurs.  The  ASRS 
reports  appear  to  indicate  that  this  is  particularly  troublesome  when  the  flight  crew  get  busy 
and  lose  their  ability  to  focus  on  what  the  FMS  is  doing.  This  reported  lack  of  situational 
awareness  or  “being  in  the  loop”  is  particularly  difficult  for  most  pilots  since  their  basic 
flight  training  has  usually  emphasized  maintaining  an  awareness  of  what  the  airplane  is 
doing,  and  what  it  is  likely  to  do  next.  This  is  sometimes  described  as  “staying  ahead  of  the 
airplane.”  One  pilot  described  the  experience  as  follows: 

(123705)  “We  were  instructed  to  cross  Holey  intersection  at  1 1,000  feet.  I  was 
flying  the  aircraft  coupled  on  the  autopilot.  I  programmed  the  correct  data  into  the 
FMC  and  selected  1 1,000  on  the  mode  control  panel.  The  aircraft  indicated  a  top  of 
descent  point  in  17  miles.  Having  confidence  in  the  system,  I  switched  attention  to 
creating  waypoints  for  approach  and  appropriate  runway.  I  thought  to  myself  ‘We 
should  have  started  down  by  now’;  we  were  10  miles  from  the  intersection  and 
13,000  feet.  Immediately,  I  started  a  rapid  descent  and  we  crossed  Holey  at  12,500 
feet.  My  point  is  that  I  have  almost  3,000  hours  in  the  airplane  and  I  am  very  knowl¬ 
edgeable  in  its  operation,  but  pilots  cannot  rely  on  the  computers  to  fly  the  aircraft.” 

The  reported  lack  of  trust  in  the  FMS  that  arose  from  this  incident  was  mirrored  in  many  of 
the  other  reports  reviewed  for  this  study.  Although  not  cited  specifically,  it  was  clear  that 
many  of  the  pilots  submitting  these  reports  were,  and  still  are,  receptive  to  the  additional 
sophistication  and  efficiency  represented  by  the  FMS,  but  have  quickly  become  mistrustful 
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when  they  experienced  errors,  irrespective  of  the  cause.  The  concluding  statement  in  many 
of  the  reports  is  “use  raw  data  backup  to  verify  the  performance  of  the  FMS.”  For  example: 

(88652)  “Took  off  from  JFK  runway  31L  on  a  ‘Kennedy  1  Departure,  Breezy 
Point  Climb.’  At  400  feet  we  turned  left  to  proceed  to  CRI  VOR.  When  turn  towards 
CRI  was  initiated,  I  selected  a  Direct  to  CRI  in  the  flight  FMC.  Captain  followed  the 
command  bars  on  the  HSI  which  showed  a  course  straight  ahead.  Controller  asked 
where  we  were  heading.  He  advised  that  CRI  was  in  our  9  o’clock  position  and  gave 
us  a  left  turn  to  220  degrees.  The  map  on  our  HSI  shifted  and  CRI  VOR  showed 
correctly. . .  In  the  future,  I  intend  to  have  one  pilot  in  VOR  mode  on  HSI  with  VOR 
manually  selected  to  absolutely  verify  the  accuracy  of  the  departure  routing.” 

However,  monitoring  the  “raw  data”  is  not  as  simple  as  it  would  appear.  To  adequately 
monitor  all  of  the  relevant  data  can  mean  scanning  a  number  of  different  flight  instruments 
(FMC/CDU,  the  mode  control  panel,  the  Attitude  Director  Indicator,  etc.)  and  then  correctly 
integrating  this  information  so  as  to  construct  an  accurate  picture  of  the  FM S/aircraft’s  status. 

(86946)  “The  first  officer  was  flying  this  leg.  Initially  we  were  cleared  to  cross 
Kubbs  intersection  at  10,000  feet.  First  officer  was  inserting  data  into  the  Perfor¬ 
mance  Management  System  to  let  the  aircraft  do  it. . .  I  was  expecting  Kubbs  at 
10,000  feet  because  other  flights  on  the  frequency  had  been  assigned  it. . .  1  an¬ 
nounced  to  the  first  officer  the  miles  to  the  crossing  point  and  the  number  of  thousand 
feet  we  had  to  lose.  He  then  went  to  Vertical  Speed  Mode,  closed  the  throttles  and 
fully  extended  speed  brakes.  The  controller  then  gave  us  descent  to  1 1,000  feet. . . 

The  MLG  (medium  large  tran  iport)  was  descending  quite  rapidly.  Because  of  the 
high  sink  rate  and  close  crossing  restriction,  I  was  watching  my  flight  instruments 
quite  closely.  My  Flight  Mode  Annunciator  was  showing  Altitude  Capture  as  being 
armed  until  we  approached  10,000  feet.  At  that  point,  it  dropped  off.  We  went 
through  10,000  feet  at  a  fairly  high  rate  of  sink.  At  9,900  feet  I  pulled  back  on  the 
yoke,  the  first  officer  rearmed  the  Altitude  Preselect.  The  airplane  continued  to 
descend.  I  disengaged  the  autopilot  and  stopped  the  descent  at  9,800  with  an  abrupt 
jerk  back  on  the  yoke.  I  got  the  airplane  back  to  10,000  feet,  trimmed  and  at  the 
correct  speed,  looked  up  and  saw  1 1 ,000  feet  in  the  Altitude  Preselect  window.  Since 
the  first  officer  had  been  flying  with  the  autopilot  ON,  he  had  been  resetting  the 
ALTs.  I  got  everything  set  up,  re-engaged  the  autopilot  and  gave  the  airplane  back  to 
the  first  officer...  The  Altitude  Preselect  window  is  far  away  from  viewing  range 
especially  from  the  left  seat.  It  would  be  nice  to  have  an  Altitude  Preselect  repeater 
in  the  Flight  Mode  Annunciator  or  somewhere  close  to  the  flight  instruments.  Also,  it 
seems  difficult  sometimes  to  know  how  far  to  let  the  automatic  equipment  go  or  when 
to  step  in  and  take  command  of  the  situation...” 

Not  surprisingly,  monitoring  the  raw  data  can  be  especially  difficult  for  the  more  inexperi¬ 
enced  pilot: 

(108752)  “Descent  from  FL200  to  12,000  feet  using  the  FMC  nav  and  autopilot. 
At  approximately  15,000  feet  enter  the  tops  (of  the  clouds)  and  encountered  moderate 
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to  severe  turbulence,  heavy  rain.  Almost  simultaneously,  ATC  cleared  us  to  cross  40 
southwest  LRP  at  12,000  feet.  LRP  not  available  immediately  due  to  not  being  on 
auto-select  on  the  VOR,  and  (fix)  off  screen  on  the  CRT.  Captain  (pilot  not  flying) 
scrambled  to  find  the  airway  chart  to  get  the  VOR  frequency  while  I  got  engine 
anti-ice  and  ignition  turned  on.  The  captain  began  adjusting  radar  to  find  out  why  we 
were  getting  heavy  rain  and  turbulence.  When  DME  finally  locked  on  LRP,  it  read 
3 1  miles  (southwest  of  LRP).  I  deployed  spoilers  and  turned  off  the  auto  thrust.  Rain 
and  turbulence  worsened  in  descent.  As  we  approached  12,000, 1  observed  airspeed 
decreasing.  Not  immediately  realizing,  due  to  concern  about  the  extreme  turbulence, 
that  the  autopilot  was  leveling  the  aircraft  at  12,000.  Without  auto  thrust  being 
available,  I  turned  off  the  autopilot.  The  aircraft  was  trimmed  nose  down  and  contin¬ 
ued  descent  below  12,000.  The  captain  realized  the  problem  and  immediately  called 
out  altitude.  Flew  the  aircraft  back  to  12,000  and  reengaged  the  autopilot. . .  Contrib¬ 
uting  factors:  Proficiency  - 1  am  junior  on  (this  aircraft),  have  been  mostly  assigned 
for  the  last  six  months  as  relief  pilot  or  with  restricted  captain.  Consequently,  I  flew 
one  leg  in  October,  two  in  November,  one  in  December,  none  in  January,  one  in 
February  and  none  in  March.  This  was  my  sixth  leg  in  six  months. . .  ATC  procedure 
-  assignment  of  a  crossing  restriction  only  10  miles  from  the  crossing  fix,  using  a 
navaid  which  is  behind  an  aircraft  using  FMC  equipment  imposed  an  excessive 
workload  on  the  crew  with  too  litde  time  to  set  it  up. . .  ATC  should  avoid  short  range 
crossing  restrictions.  Controllers  should  be  trained  on  the  operational  characteristics 
of  FMC  (equipped)  aircraft.” 

Clearly,  the  issue  of  knowing  what  the  FMS  is  going  to  do  is  a  critical  issue.  Consequently, 
an  important  part  of  the  FMS  Description/Characterization  analysis  will  involve  looking  at 
what  data  are  available  to  the  crew  for  monitoring  FMS/aircraft  status,  how  easy  it  is  to 
access  this  data,  and  how  informative  the  data  are  for  accurately  assessing  future  FMS  “be¬ 
havior.” 


4.12.2  FMS  Algorithmic  “Behavior” 

The  verification  process  is  compounded  by  the  fact  that,  in  many  cases,  by  the  time  the  crew 
is  able  to  detect  that  the  FMS  is  not  going  to  respond  correctly,  it  may  be  too  late  to  compen¬ 
sate.  FMS  response  is  determined  not  only  by  crew  inputs  but  also  by  software  algorithms 
that  define  when  to  initiate  the  inputs  made  by  the  crew.  These  algorithms  are  designed  in 
accordance  with  a  variety  of  criteria,  one  of  which  is  to  optimize  aircraft  performance  so  as 
to  minimize  fuel  usage.  However,  these  algorithms  can  create  problems  for  the  crew,  as  is 
shown  by  the  substantial  number  of  ASRS  reports  that  involved  vertical  navigation.  The 
referenced  reports  often  dealt  with  problems  such  as  altitudes  not  being  captured,  crossing 
restrictions  not  being  met,  and  climb  and  descent  rates  being  excessive.  As  Table  4-3 
showed,  crossing  restrictions  not  met  represent  40%  of  all  flight  phase  categories  in  these  99 
reports. 

In  many  of  the  reports,  an  altitude  excursion  was  the  result  of  the  FMS  not  performing  as 
expected,  or  the  flight  crew  not  recognizing  that  the  FMS  was  not  working  properly  or  was 
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mis-programmed.  It  is  likely  that  many  of  these  inc.  ients  occur  because  the  FMS  algorithms 
are  designed  to  level  off  the  aircraft  at  the  last  minute.  If  the  flight  crew  missed  the  900-foot 
and  300-foot  cues  that  signal  approaching  the  selected  altitude,  this  leveling  off  is  the  major 
cue  to  the  crew  that  the  desired  altitude  will  be  acquired.  The  last-minute  nature  of  the 
leveling-off  process,  coupled  with  missing  the  altitude  alert  cues,  means  that  the  crew  knows 
a  problem  has  occurred  only  when  the  airplane  does  not  level  off,  at  which  time  it  is  probably 
too  late  to  perform  any  actions  that  can  prevent  the  altitude  deviation.  One  pilot  described 
the  experience  this  way: 

(125410)  “On  departure,  we  were  cleared  to  climb  to  12,000  feet,  but  we  had  an 
altitude  deviation  and  climbed  to  12,450  before  returning  to  our  assigned  altitude  of 
12,000.  At  1 1,000, 1  called  1,000  to  go  and  then  looked  back  outside  to  clear  for 
traffic  in  the  turn.  I  looked  back  inside  and  saw  that  we  were  at  1 1,800  climbing  at 
4,000  feet  per  minute  (fpm).  I  pushed  forward  on  the  yoke  the  same  time  I  said 
’  12,000’ . . .  This  aircraft  is  a  popular  modem  transport  with  an  excellent  thrust  to 
weight  ratio,  glass  cockpit,  auto  throttles,  FMC’s,  the  works.  With  this  aircraft’s 
power  it  has  quite  a  good  climb  rate  and  the  automated  systems  fly  the  aircraft  ex¬ 
ceptionally  well,  but  they  do  not  climb  or  descend  the  aircraft  according  to  the 
Airman’s  Information  Manual  (AIM).  It  is  not  at  all  unusual  to  approach  within 
300-400  feet  of  an  altitude  at  4,000  fpm.  The  computer  will  capture  the  altitude  with 
about  a  1.25  G  pull  or  a  .75  G  pushover  so  that  the  passengers  don’t  really  feel  it. . .  I 
feel  that  if  the  AIM  descent  and  climb  rates  were  programmed  into  the  computer  that 
would  be  a  better  system.  That  way,  high  vertical  speed  in  the  last  1,000  feet  would 
be  the  exception  and  not  the  rule  and  much  more  likely  to  result  in  a  timely  level  off 
instead  of  an  altitude  bust.  After  all,  it  would  take  more  that  30  seconds  to  overfly/ 
underfly  an  altitude  by  the  magic  300  feet  at  500  fpm  as  opposed  to  only  slightly 
more  that  4  seconds  it  would  take  at  4,000  fpm.” 

This  type  of  algorithm  can  encourage  the  occurrence  of  altitude  excursions  since  it  does  not 
leave  much  room  for  error  compensation.  The  pilot’s  recommendation  for  a  modification  to 
the  altitude  capture  logic  of  the  autoflight  system  to  slow  the  climb  rate  for  the  last  1 ,000  feet 
appears  reasonable  when  the  performance  of  this  particular  aircraft  is  considered. 


4.12.3  Improper  Use  of  the  FMC  Automation  Level 

The  FMS  is  a  complex  system  supporting  several  levels  of  automation  that  can  be  used  for 
controlling  the  aircraft.  Reading  the  ASRS  reports,  however,  suggests  that  the  crew  do  not 
always  take  best  advantage  of  these  automation  levels.  Several  ASRS  reports  show  that  the 
crew  tend  to  rely  only  on  the  FMC  to  control  the  aircraft.  The  FMC,  however,  is  intended  for 
long-term  control  of  the  aircraft.  In  cases  requiring  more  immediate  response  from  the 
aircraft,  better  automation  choices  are  the  flight  director,  the  autopilot,  or  even  manual 
control  if  the  temporal  response  is  critical.  The  following  report  describes  the  problem: 

( 1 12925)  “. .  .Center  cleared  us  to  cross  Lendy  at  FL230.  The  Captain  pro¬ 
grammed  the  FMC  for  this  crossing  just  as  the  #1  flight  attendant  came  into  the 
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cockpit  to  complain  about  something.  Neither  one  of  us  noticed  the  FMC  reverted  to 
speed  mode  from  V  NAV  path  mode.  About  15  mile  from  Lendy,  I  noticed  we  were 
much  too  high  to  make  the  restriction. . .  Center  then  cleared  us  to  cross  LG  A  at 
FL190  at  250  knots.  The  Captain  began  programming  the  FMC  when  we  should 
have  started  right  down.  As  a  result,  we  had  to  make  a  high  speed  descent  to  FL190 
to  make  altitude  and  we  could  not  slow  down  to  250  knots.  The  Captain  commented 
that  he  always  tells  new  co-pilots  to  begin  the  descent  before  programming  the  FMC 
if  there  is  any  doubt  about  making  the  restriction. . .  We  did  not  fly  the  airplane  first 
and  program  the  FMC  second.  We  relied  too  much  on  the  FMC  in  a  situation  where 
they  require  too  much  input  and  monitoring  and  increase  the  workload.” 

Based  on  this  report,  it  would  appear  that  pilots  who  went  to  a  manual  reversion  early,  either 
by  hand  flying  the  airplane  using  raw  data  or  by  obtaining  raw  navigation  data  for  back-up 
purposes,  did  the  best  in  minimizing  the  FMS-related  incident.  Those  pilots  who  reported 
that  they  continued  to  try  and  program  the  FMC/CDU  and/or  “troubleshoot”  the  system, 
while  trying  to  fly  the  aircraft  and  meet  the  clearance  objectives,  appeared  to  be  the  ones  who 
quickly  found  that  the  incident  had  progressed  to  an  uncomfortable  stage.  Fortunately  or 
unfortunately,  it  would  appear  that  experience  (i.e.,  time  with  the  system)  is  the  only  way  to 
compensate  for  the  difficulties  associated  with  using  the  FMS  automation  features  to  perform 
“short-term”  ATC  clearance  procedures  or  maneuvers. 

The  question  arises  as  to  why  crews  are  reluctant  to  use  automation  levels  other  than  the 
FMC.  In  at  least  one  case,  the  reason  was  obvious.  The  captain  insisted  that  the  first  officer 
use  the  FMC  because  the  company’s  policy  was  always  to  use  it.  In  other  cases,  however, 
the  reason  is  not  obvious.  One  possible  reason  may  be  the  flight  crew’s  difficulty  in  moving 
between  automation  levels,  especially  in  moving  from  flight-director  or  autopilot  control  to 
FMC  control.  This  hypothesis  needs  to  be  addressed  in  greater  detail  in  the  description/ 
characterization  study. 

Improper  use  of  the  FMC  automation  level  can  also  include  nonstandard  procedures,  as  in  the 
following  example: 

(122778)  “We  were  cleared  to  cross  40  NM  west  of  Linden  VOR  to  maintain 
FL270.  The  captain  and  I  began  discussing  the  best  method  to  program  the  CDU  to 
allow  the  performance  management  system  to  descend  the  aircraft.  We  had  a  differ¬ 
ence  of  opinion  on  how  to  best  accomplish  this  task  (since  we  are  trained  to  use  all 
possible  on-board  performance  systems).  We  wanted  to  use  the  aircraft’s  capabilities 
to  its  fullest.  As  a  result,  a  late  descent  was  started  using  conventional  autopilot 
capabilities  (vertical  speed,  maximum  indicated  mach/airspeed  and  speed  brakes). 
Near  the  end  of  descent,  the  aircraft  was  descending  at  340  KIAS  and  6000  feet-per- 
minute  rate  of  descent.  The  aircraft  crossed  the  fix  approximately  250-500  feet  high. 
Unfortunately,  we  made  no  call  to  ATC  to  advise  them  of  the  possibility  of  not 
meeting  the  required  altitude/fix.  This  possible  altitude  excursion  resulted  because: 
(1)  captain  and  first  officer  had  differences  of  opinion  on  how  to  program  the  descent. 
A)  Both  thought  their  method  was  best:  the  captain’s  of  programming  (fooling)  the 
computer  to  believe  anti-ice  would  be  used  during  descent,  which  starts  the  descent 
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earlier;  the  first  officer’s  of  subtracting  five  miles  from  the  nav  fix  and  programming 
the  computer  to  cross  five  miles  prior  to  Linden  at  FL270.  B)  A  minor  personality 
clash  between  the  captain  and  first  officer  brought  abou..  by  differences  of  opinion  on 
general  flying  duties,  techniques  of  flying  and  checklist  discipline.  C)  Time  wasted 
by  both  captain  and  first  officer  (especially  first  officer)  in  incorrectly  programming 
CDU  and  FMS  for  descent,  which  obviously  wasted  time  at  level  flight,  which  should 
have  been  used  for  descent.  Observation:  as  a  pilot  for  a  large  commercial  carrier  at 
its  largest  base,  we  seldom  fly  with  the  same  cockpit  crew  member.  This  normally 
does  not  create  a  problem.  I  do,  however,  feel  that  with  the  “new  generation”  glass 
cockpits  being  on  the  property  approximately  six  years;  this  can  cause  a  bit  more 
difficult  transition  than,  say  month  to  month  cockpit  crew  change  on  a  727  or  pre- 
EFIS  DC-9.  I  have  flown  commercially  for  10  years,  and  have  flown  two-man  crew 
aircraft  for  eight  of  those  10.  The  toughest  transition  for  me  is  to  determine  who 
shares  pilot  flying  and  pilot-not-flying  duties.  This  historically  (3  years)  has  been 
most  difficult  when  the  other  crew  member  has  transferred  from  a  3-man  cockpit  to  a 
2-man  “glass  cockpit.”  This  is  especially  pertinent  when  the  crew  member  has  been 
on  a  3-man  crew  aircraft  for  a  number  of  years.  As  first  officer,  when  you  are  the 
pilot-not-flying,  you  accomplish  your  normal  duties.  However,  often  times  when  one 
is  the  pilot  flying,  he  also  has  to  do  the  pilot-not-flying  duties  to  the  extent  that  it  is 
required  on  2-man  cockpits,  whether  they  be  conventional  or  EFIS.  This  obviously 
can  lead  to  a  myriad  of  problems.  Add  weather  problems  or  an  airport  such  as  Wash¬ 
ington  National,  Laguardia  or  Orange  County,  and  problems  can  accelerate  with 
alarming  rapidity.” 

Appropriate  response  to  an  ATC  instruction  involves  two  elements:  selecting  the  most 
appropriate  automation  level  in  order  to  produce  a  timely  response  to  that  instruction,  and 
using  that  automation  level  correctly.  In  the  example  just  described,  the  flight  crew  did  not 
even  consider  the  issue  of  appropriate  automation  level  but  chose  to  focus  on  how  to  fool  the 
FMC  into  producing  a  timely  response.  As  a  result,  they  found  themselves  in  the  position  of 
not  being  able  to  use  the  FMC  at  all,  and  had  to  push  the  aircraft  to  its  performance  limits  in 
order  to  try  to  accomplish  the  objective. 

4. 1.2.4  FMC  Programming  Demands 

Many  of  the  ASRS  reports  included  the  complaint  that  the  FMC/CDU  is  difficult  and  time- 
consuming  to  program.  This  complaint  is  magnified  in  the  case  where,  for  whatever  reason, 
the  FMC  rejects  the  programmer’s  (pilot  not  flying)  initial  attempt.  Under  these  conditions, 
it  is  not  uncommon  for  the  pilot  flying  to  then  get  involved  as  well,  at  which  point  no  one  is 
flying  the  airplane.  The  frequency  of  these  comments  gives  rise  to  the  impression  that  the 
design  of  the  current  FMC/CDU  does  not  appear  to  be  optimal  for  the  pilot’s  needs  in  the 
operational  environment. 

(107738)  “On  descent  into  MSP  on  the  Bunker  6  arrival,  we  were  given  a  clear¬ 
ance  to  cross  Cedar  intersection  at  or  below  15,000  feet  and  to  maintain  10,000  feet. 
At  the  time  we  were  southwest  of  RWF.  (Cedar  is  26  DME  southwest  MSP  Vortac). 
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I  was  the  PNF  (pilot  not  flying),  so  I  put  the  clearance  into  the  FMS  CDU.  The 
captain  had  programmed  the  arrival  for  runway  1 1R  but  upon  getting  ATIS,  the 
approaches  were  to  runway  29,  so  he  started  changing  the  arrival.  He  also  was  on 
vertical  speed  for  descent  instead  of  V  NAV.  After  reprogramming  the  Cedar  cross¬ 
ing,  the  altitude  was  erased  and  never  re-entered.  I  was  also  spending  too  much  time 
with  other  duties  like  calling  gate  radio  and  watching  captain  (conduct)  the  descent 
check  to  notice  flight  path.  At  one  point,  I  noticed  a  recalculation  of  14,400  at  Cedar 
and  assumed  all  was  well.  Somehow  I  had  mistaken  Caase  (MSP  8  DME)  for  Cedar 
and  thought  we  still  had  plenty  of  distance  to  descend.  Center  called  us  as  we  passed 
Cedar,  reminded  us  of  the  clearance  and  asked  our  altitude.  We  were  at  FL230 
instead  of  below  15,000.  After  a  short  vector,  MSP  center  said  ‘MSP  approach  will 
accept  you,  call  them ...’  In  summary,  we  missed  our  crossing  restriction  due  to  pilot 
flying  doing  pilot  not  flying  duties,  that  is,  extensive  CDU  reprogramming  and  not 
monitoring  the  flight  path.  I  also  didn’t  monitor  the  flight  path  close  enough  while 
involved  in  other  duties.  We  received  the  clearance  from  MSP  center,  but  failed  to 
comply.  Only  one  person  should  be  doing  heads  down  FMS  work  while  the  other 
monitors  the  flight  path.  Very  busy  time  in  two  person  cockpit  requires  extreme 
discipline.” 

(87750)  I  was  operating  the  aircraft  on  autopilot  at  the  time.  The  Captain  was 
making  the  required  in-range  call  to  Washington  National  Operations  at  the  time.  I 
had  just  completed  a  V  NAV  descent  to  FL270  when  we  were  given  a  vector  heading 
followed  shortly  by  a  clearance  to  descent  to  FL240.  Since  the  Captain  was  on  the 
other  radio,  I  acknowledged  the  clearance  and  reset  the  Altitude  Alert  on  the  Mode 
Select  Panel  (MCP)  to  24,000.  I  then  pulled  up  the  cruise  page  on  the  Flight  Manage¬ 
ment  Computer  (FMC)  and  entered  FL240  into  it  and  executed.  In  my  mind  the 
Autopilot/Flight  Director  was  still  in  the  V  NAV  Mode  and  in  that  Mode,  executing 
the  cruise  altitude  of  240  should  have  started  a  descent  to  that  altitude.  The  aircraft 
had,  however,  leveled  off  at  270  and  transferred  into  the  Altitude  Hold  Mode,  which 
would  not  automatically  respond  to  the  setting  and  executing  of  a  new,  lower  altitude 
in  the  FMC.  Meanwhile,  the  Captain  had  tuned  the  ATIS  and  I  heard  from  his  cock¬ 
pit  speaker  that  Washington  National  had  switched  from  the  north  operation  we  had 
expected  and  had  set  in  the  FMC  to  a  south  operation.  I  pulled  up  the  Arrival  Page  on 
the  FMC  and  reset  the  computer  to  the  new  arrival  while  the  Capt  was  copying  the 
ATIS.  In  the  meantime,  the  aircraft  continued  to  cruise  at  FL270.  Shortly  thereafter, 
Washington  Center  called  and  asked  to  verify  our  altitude,  at  which  time  I  realized 
what  had  happened  and  started  an  immediate  descent.  There  was  no  indication  from 
Center  that  the  failure  to  descend  had  jeopardized  safety. . .  In  training  they  empha¬ 
sized  that  one  pilot  should  fly  and  the  other  should  program  the  FMC.  I  understood 
and  believe  that,  however,  most  of  the  experience  pilots  I  had  been  flying  with  since 
training  seemed  to  do  most  of  their  own  FMC  Management  while  flying,  especially  if 
I  was  otherwise  occupied  on  the  other  radio.  Following  that  example,  which  may 
work  for  an  experienced  large  transport  pilot  but  certainly  not  for  one  at  my  level,  I 
fell  into  the  trap  they  had  warned  me  about!  I  pushed  the  buttons,  but  I  did  not  check 
the  response  to  the  input  before  going  on  to  something  else.  No  one  was  flying  the 
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aircraft.  In  the  future  I  will  initiate  all  altitude  changes  on  the  MCP  (using  flight  level 
change)  when  the  other  pilot  is  unable  to  enter  data  in  the  FMC,  and  will  check  the 
basic  aircraft  instruments  for  a  response  to  the  inputs  I  make  to  the  complex,  multi¬ 
faceted  auto  Flight  Control  system.” 

The  substantial  amount  of  programming  that  can  be  required  to  modify  the  flight  plan  while 
in  the  air  can,  in  effect,  negate  the  workload  advantages  of  the  FMS  automation.  In  addition, 
this  programming  is  likely  to  be  required  during  periods  that  have  a  high  workload  nature  to 
begin  with,  that  is,  transitions,  altitude  changes,  etc.  Periods  of  high  workload  are  to  be 
expected  in  the  cockpit  of  modem  air  transport  aircraft.  The  important  issue  to  note  is  not 
that  high  workload  periods  exist  but  that  the  crew  interface  to  the  FMC/CDU  often  exacer¬ 
bates  an  already  busy  time.  The  worst  case  situation  arises  when  both  pilots  become  so 
focused  on  dealing  with  the  FMC/CDU  that  they  diminish  their  attention  to  flying  the  air¬ 
plane.  This  last  point  gave  rise  to  a  common  observation  in  many  of  the  reports.  Many  pilots 
stated  that  in  the  future  they  will  focus  on  flying  the  airplane  first  and  dealing  with  the  FMS 
second. 

The  awareness  of  those  pilots  who  stated  they  reduced  their  reliance  on  the  automation  when 
the  situation  started  to  become  confusing  or  the  system  appeared  to  be  malfunctioning  is 
commendable.  This  knowledge,  however,  only  seems  to  have  been  developed  after  gaining 
sufficient  operational  experience  with  the  FMS.  The  operational  demands  of  the  two-pilot 
high  performance  aircraft  in  the  dynamic  environment  of  terminal  operations  and  air  traffic 
control  appear  to  be  an  ongoing  problem  and  should  be  considered  in  the  design/re-design  of 
the  next  generation  FMS  user  interface  and  feedback  system. 

Another  issue  cited  in  some  of  the  reports  was  the  difficulty  that  the  flight  crew  had  in  rec¬ 
ognizing  programming  errors  once  the  data  were  entered  into  the  FMC/CDU.  These  pilots 
maintained  that  the  FMC  should  be  more  capable  in  reviewing  and  alerting  the  pilots  to 
entries  that  appear  to  be  in  error  or  do  not  logically  fit  with  the  rest  of  the  data  entered.  This 
“logic  parameter  check”  might  include  such  elements  as  the  ability  to  recognize  that  a  navi¬ 
gation  fix  was  entered  in  error,  even  though  it  is  in  the  database,  is  in  a  different  region  of  the 
country  than  the  filed  route  of  flight,  or  was  an  airport  identifier,  not  a  waypoint.  In  this  case, 
the  FMC/CDU  might  highlight  and  ask  for  verification  from  the  crew  before  accepting  the 
fix.  (Note:  It  would  appear  that  the  A320  FMGS  system  checks  for  duplicate  names  and 
requires  the  pilot  to  select  the  appropriate  fix,  which  is  a  step  in  the  right  direction). 


4.12.5  Multiple  FMC  Page  Monitoring  Requirements 

The  organization  of  information  within  the  FMC/CDU  appears  to  be  an  issue  for  some  pilots. 
Monitoring  the  overall  status  and  performance  of  the  aircraft  includes  being  aware  of  fuel 
status,  lateral  path,  position,  vertical  path,  and  so  on.  To  adequately  monitor  aircraft  status 
by  means  of  the  FMC,  the  crew  must  review  the  information  that  is  presented  on  a  number  of 
different  pages  which  are  accessed  by  means  of  a  number  of  mode  and/or  line  select  keys. 
Extensive  monitoring  of  the  FMC/CDU  diminishes  the  crew's  ability  to  monitor  the  data  in 
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the  mode  control  panel  at  the  same  time,  thus  creating  the  possibility  for  missing  important 
information  about  the  status  of  the  aircraft. 

(1 19836)  “Approach  DEN  from  the  east  on  J80  the  captain  (pilot  flying)  asked 
copilot  (pilot  not  flying)  to  request  FL390  due  to  building  thunderstorms  over  the 
Rocky  Mountains.  I  (copilot)  put  FL390  in  the  right  FMS  computer  to  check  aircraft 
capability  for  FL390.  After  entering  and  executing  FL390  in  1  L  on  FMS,  I  verified 
that  the  altitude  window  on  the  mode  control  panel  was  at  35,000  feet  and  that  the 
autothrottles  did  not  add  power  for  the  climb.  At  this  point,  the  mode  control  panel 
altitude  window  was  holding  the  aircraft  at  current  cruise  altitude  of  35,000  feet.  This 
has  been  an  accepted  procedure  in  this  situation.  After  checking  altitude  capability  in 
the  FMC,  I  mentioned  to  the  captain  that  we  could  make  FL390  and  would  save 
approximately  one  percent  of  fuel  with  the  climb.  This  whole  check  took  probably 
less  than  20-30  seconds.  I  then  called  DEN  ATC  and  was  advised  to  expect  FL390  in 
approximately  two  minutes  due  to  traffic.  Anticipating  the  higher  altitude,  I  left 
FL390  in  the  FMC  active  cruise  page,  once  again  checking  to  make  sure  the  window 
read  35,000  feet.  I  continued  to  prepare  the  ACARS  position  report  to  be  transmitted 
over  DEN.  We  were  approximately  three  minutes  east  of  DEN.  I  remember  check¬ 
ing  the  ETA  for  SLC  and  entering  the  fuel  over  DEN  as  22.5.  Since  I  was  preparing 
the  position  report  I  changed  from  the  Cruise  page  on  the  FMC  to  the  Progress  page, 
but  the  captain  still  had  the  Cruise  page  in  view  with  the  FL390  Cruise  active  page  on 
it.  During  the  minute  or  minute  and  a  half  of  preparing  the  ACARS  position  report 
and  waiting  for  the  ATC  clearance  to  FL390  the  captain  (pilot  flying)  changed  the 
mode  control  panel  altitude  window  to  39,000  feet,  anticipating  the  climb.  Of  course, 
the  FMC  not  being  constrained  at  35,000  feet  any  longer  started  a  slow  climb  to 
FL390.  The  captain  also  began  a  passenger  announcement  to  the  passengers  about 
DEN  and  the  turbulence,  and  that  we  expected  a  climb  to  a  higher  altitude  shortly. 

The  center  called,  ‘Maintain  FL350.’  Without  even  hesitating,  I  responded  ‘Roger, 
maintain  350.’  By  this  time  the  captain  (pilot  flying)  had  already  started  a  push-over. 
The  aircraft  had  reached  an  altitude  of  approximately  FL357.  After  the  aircraft  was 
returned  to  FL350, 1  checked  the  mode  control  panel  altitude  window  and  was  sur¬ 
prised  to  see  39,000  feet.  We  returned  it  to  35,000  feet,  our  cleared  altitude.  Within  a 
few  minutes.  Center  cleared  to  FL390.  Crew  coordination  and  lack  of  communica¬ 
tion  may  have  contributed  to  the  altitude  excursion  and  conflict.  The  mode  control 
panel  altitude  window  is,  in  my  judgment,  the  last  step  in  the  altitude  change  process, 
to  be  changed  after  clearance  has  been  received.  The  autoflight  system  will  not 
depart  the  mode  control  panel  altitude,  even  if  the  FMC  is  programmed  for  a  different 
altitude.” 

This  example  provides  a  feel  for  the  number  of  information  sources  the  crew  must  monitor. 
From  the  description,  it  appears  that  the  first  officer  looked  at,  as  a  minimum,  the  following 
information  sources: 

•  The  altitude  window  on  the  Mode  Control  Panel 

•  Autothrottle  status 
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The  Climb  page  to  assess  aircraft  capability  for  FL390 
The  active  Cruise  page 

The  Progress  page  to  determine  position,  ETA,  and  to  enter  remaining  fuel 


while,  at  the  same  time,  preparing  a  company  progress  report.  Monitoring  a  number  of  pages 
through  the  FMC/CDU  can  contribute  to  substantial  cognitive  workload  in  that  the  pilot  must 
remember  what  page  is  appropriate  for  finding  the  desired  information  and  how  to  access  that 
page,  either  through  mode  select  or  line  select  keys.  The  overall  layout  of  information  in 
terms  of  the  types  of  information  on  a  given  FMC/CDU  page  and  the  navigational  tools  for 
accessing  these  pages  needs  to  be  addressed  in  terms  of  how  effectively  the  most  critical  set 
of  information  can  be  found  for  a  given  set  of  tasks. 

4.12.6  Complex  ATC  Clearances 

Under  ideal  conditions,  the  flight  plan  programmed  into  the  FMC  during  preflight  will  be  the 
flight  plan  that  is  actually  flown.  If  this  were  always  the  case,  virtually  all  of  the  errors  that 
occur  through  FMS  use  would  disappear.  One  reason  as  to  why  flight  plans  have  to  be 
changed,  in  the  air,  is  Air  Traffic  Control  and  today’s  complex  airspace.  In  areas  of  high 
traffic  density,  ATC  clearances  issued  to  a  particular  flight  can  be  numerous,  and  in  some 
cases  contradictory,  making  effective  use  of  the  FMS  difficult  due  to  re-programming  re¬ 
quirements,  and/or  the  time  needed  for  the  FMS  to  respond  to  the  new  commards.  It  is  also 
likely  that  ATC’s  understanding  of  the  capabilities  and  limitations  of  FMS-equipped  air¬ 
planes  may  not  be  what  pilots  anticipate.  High  traffic  levels  with  correspondingly  high  ATC 
workloads  and  complex  airspace  result  in  very  dynamic  situations  which  often  require  timely 
and  flexible  responses  from  the  flight  crew. 

The  issue  of  high  pilot  workload  in  high  traffic  areas  can  be  a  problem  for  all  flight  crews, 
not  just  those  flying  advanced  cockpit  airplanes.  Advanced  cockpit  airplanes,  however,  often 
engender  workload  difficulties  that  are  unique  as  portrayed  in  the  following  report. 

(114409)  “During  climbout  from  DFW  the  controller  issued  a  clearance  to  turn  to 
a  heading  of  300  degrees,  intercept  the  DFW  274  degree  radial,  climb  to  and  maintain 
16,000  feet,  and  maintain  250  knots  until  advised.  As  the  first  officer,  and  pilot  not 
flying,  I  proceeded  to  read  back  the  clearance  and  program  the  FMS  computer  for 
route,  speed  and  altitude.  The  Captain  selected  speed  intervention  of  250  knots  and 
heading  to  the  assigned  intercept  heading.  He  also  attempted  to  couple  the  vertical 
navigation  of  the  autopilot  but  this  was  not  accepted  so  he  used  flight  level  change 
and  speed  of  250  knots  to  climb  to  the  assigned  altitude  of  16,000  feet  at  250  knots... 
Unfortunately,  the  autopilot  entered  an  altitude  capture  mode  approaching  10,000  feet 
instead  of  continuing  to  climb  to  16,000.  In  addition,  the  auto  throttle  disregarded  the 
250  kt  restriction  and  continued  to  accelerate.  The  controller  called  to  ask  our  speed 
and  as  I  looked  up  from  the  FMS,  I  noticed  approximately  330  knots. . .  At  the  time 
of  the  incident,  the  two  of  us  were  given  an  intercept  heading,  an  altitude  change,  and 
a  speed  restriction.  In  the  process  of  attempting  to  accomplish  the  programming  for 
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the  FMS,  listen  for  ATC,  and  watch  for  traffic,  the  airspeed  capture  of  the  auto 
throttles  was  overlooked  until  the  speed  approached  330  knots.” 

In  this  case,  the  flight  crew  was  busy  dealing  with  a  relatively  complex  clearance  from  ATC 
which  included  a  speed  restriction.  The  problem  leading  to  the  incident  arose  when  they 
tried  to  program  the  FMC/CDU  to  handle  the  clearance  and  it  did  not  work  as  planned.  The 
pilots  depended  on  the  FMS  to  help  them  comply  with  the  ATC  restriction  of  250  knots  but 
its  subsequent  malfunction,  or  mis-programming  on  their  part  (not  clear  in  the  report),  led  to 
their  exceeding  the  speed  limitation.  It  is  likely  that  the  flight  crew  would  have  recognized 
the  problem  soon  due  to  an  over  speed  warning  if  ATC  had  not  brought  it  their  attention. 

When  ATC  and  the  flight  crew  are  both  busy,  problems  can  become  even  more  complicated 
since  neither  may  have  the  time  to  point  out  errors  or  ask  questions.  The  following  ASRS 
report  addresses  this  issue. 

(121873)  “We  were  approximately  100  west  of  FNT  when  we  were  given  a 
descent  restriction  of  FL240,  64  miles  northwest  of  FNT.  FNT  was  not  on  our  route 
of  flight,  therefore,  in  order  to  enter  the  restriction  into  the  ‘legs’  page  of  our  FMC  it 
was  necessary  to  build  it  into  our  route  at  the  appropriate  place...  It  was  necessary  to 
subtract  the  appropriate  amount  of  distance  from  the  closest  point  to  the  east  of  the  65 
mile  point.  I  accomplished  this  and  made  the  restriction  as  requested.  Then  while 
talking  to  DTW  approach  control,  we  were  given  holding  instructions.  The  instruc¬ 
tions  were  to  hold  northwest  of  the  SVM  322/25  fix  with  right  turns,  10  mile  legs  at 
FL200,  EFC  at  2010.  Again  SVM  was  not  on  our  route.  Therefore,  it  had  to  be 
programmed  into  the  ‘legs’  page  of  the  FMC  at  the  appropriate  point  then  the  holding 
info  had  to  be  put  into  the  holding  page.  I  entered  the  info  correctly  except  that  I 
entered  SVM  322  degree  radial  and  left  out  the  25  DME  fix. . .  The  controller 
changed  our  assigned  altitude  approximately  five  times  to  eventually  12,000  feet. 

The  controller  was  very  busy  and  called  us  flight  ‘ABCD’  instead  of  ‘ABEF.’  There 
was  another  aircraft  with  the  same  numbers  as  the  first  two  digits  of  its  four  number 
call  sign  (as  ours)  and  it  appeared  he  was  combining  our  call  sign  with  his.  While  I 
was  off  the  ATC  frequency  talking  to  the  company  about  our  delay,  ATC  called  and 
told  us  we  were  past  our  holding  fix,  make  an  immediate  left  turn  and  level  at  13,000 
feet. . .  I  realized  my  mistake  and  began  to  immediately  rebuild  the  route  we  were 
filed  and  establish  the  correct  holding  fix.  After  this  was  accomplished,  we  discov¬ 
ered  the  holding  fix  that  we  were  assigned  was  two  miles  west  of  Pinto  intersection. 
Pinto  was  on  our  original  route  of  flight.  DTW  approach  control  had  been  giving 
other  aircraft  hold  instructions  for  Pinto,  my  question  is  why  weren’t  we  given  the 
same  instructions?...  The  error  was  mine  (in  this  situation),  however,  I  feel  that 
controllers  need  to  understand  the  increase  in  workload  that  is  placed  on  a  two-man 
crew  using  an  FMC  when  given  restrictions  and  holding  instructions  off  of  a  fix  not 
on  their  route.” 

This  situation  encompasses  a  busy  flight  crew,  a  busy  controller  and  navigation  fixes  not  in 
the  original  flight  plan.  The  flight  crew’s  observation  that  the  controllers  should  be  aware  of 
the  increased  workload  caused  by  using  fixes  not  in  the  flight  plan  is  understandable  but  may 
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be  unreasonable.  In  this  case,  it  was  clear  that  the  controller  was  also  busy  and  was  trying  to 
keep  the  overall  situation  from  getting  worse.  The  relationship  between  ATC  and  the  pilots 
is  symbiotic  in  that  each  often  depends  on  the  other  to  assume  additional  responsibility  when 
one  becomes  overburdened.  The  desire  of  this  flight  crew  for  ATC  to  remain  aware  of 
appropriate  fixes  (i.e.,  those  in  the  FMS  database)  may  be  outside  the  realm  of  what  is  practi¬ 
cal  for  ATC.  The  real  question  underlying  the  flight  crew’s  desire  is  how  do  FMSs  best  fit 
within  the  ATC  operational  environment  today  and  in  the  future?  Do  you  change  the  ATC 
system  to  accommodate  FMS-equipped  airplanes  or  do  you  design/re-design  FMSs  to  work 
within  the  constraints  of  the  next  generation  automated  ATC  system?  The  solution  probably 
lies  in  a  positive  answer  to  both  questions,  but  identifying  the  specific  types  of  change  will 
take  time  and,  as  such,  will  not  address  the  problems  experienced  by  flight  crews  today. 

The  issue  of  ATC  sensitivity  to  FMS-related  workload  does  need  to  be  addressed.  Under 
high  traffic  conditions,  this  may  not  always  be  possible.  However,  including  some  type  of 
familiarization  with  the  FMS  as  a  standard  part  of  controller  training  may  have  some  value. 

(114392)  “New  copilot  flying,  having  a  lot  of  difficulty  with  the  FMC.  We  had 
been  cleared  to  cross  a  point  100  miles  out  of  Boiler  at  FL260  which  we  did.  We 
were  then  given  a  delaying  vector  for  spacing.  We  were  then  cleared  direct  to  Boiler 
and  told  to  descend  to  FL240.  Copilot  was  having  a  difficult  time  trying  to  get  the 
right  page  and  right  line  to  program  the  computer  to  descend.  We  did  delay  our 
descent  to  the  point  where  ATC  asked  us  if  we  had  left  FL260  yet.  I  feel  training 
methods  need  to  be  improved.  As  I  will  be  faced  with  a  lot  of  new  copilots  I  plan  to 
change  my  method  of  operations  to  ensure  this  sort  of  thing  does  not  happen.  I  do  not 
believe  that  ATC  controllers  understand  the  operation  of  computer  driven  aircraft. 

We  are  plagued  with  late  clearances  and  frequent  changes.  That  is,  I  am  told  to 
expect  a  crossing  20  west  of  PMM  at  FL  200  and  at  320  knots.  Computer  plans  a  last 
point  of  descent.  Controller  then  says  cross  15  west  at  FL200  and  320  knots.  It’s  too 
late  to  change  the  program.  Use  speed  brakes  and  a  high  dive  (rate).  Also  it  would 
be  nice  if  the  center  used  the  enroute  waypoints  instead  of  mileage  points...  These 
simple  changes  to  procedures  would  help  cut  our  workload  so  we  could  keep  our 
heads  out  of  the  cockpit  and  still  use  the  computer.” 

The  use  of  the  FMS  in  busy  airspace  in  which  multiple  clearances  from  ATC  are  likely, 
along  with  multiple  aircraft  configuration  and  speed  changes,  appear  to  make  effective  use  of 
the  FMS  difficult,  especially  for  short-term  navigation  activities.  This  difficulty  is  due  to  the 
need  for  pilots  to  remain  flexible  and  respond  quickly  to  the  needs  of  ATC.  The  FMC/CDU, 
however,  apparently  is  not  that  easy  to  re-program  and  is  not  designed  to  support  short-term 
changes.  Although  this  study  did  not  look  at  ATC-related  problems  relative  to  altitude 
specifically,  many  of  the  ATC  related  incidents  occurred  in  the  middle  altitudes  between 
10,000  feet  and  FL240.  The  complexity  of  this  airspace,  and  ATC  overall,  seems  to  be 
involving  larger  portions  of  a  given  flight’s  overall  trip.  Clearly,  the  role  of  ATC  should  be  a 
major  consideration  in  how  the  next  generation  automated  systems  are  designed  and  oper¬ 
ated.  With  the  advent  of  the  ATC  Advanced  Automation  System,  it  may  be  necessary  to  re¬ 
think  the  way  in  which  automated  aircraft  will  interface  with  the  ground-based  automation 
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systems.  Automated  time-based  “metering  and  spacing”  algorithms  may  become  the  domi¬ 
nant  mode  of  air  traffic  control  from  Top  of  Descent  to  Touchdown,  and  will  require  a  very 
sophisticated  interface  to  the  airplanes’  automation  systems,  which  will  impact  the  flight 
crews’  use  of  the  FMS. 


4.12.7  Complex  FMCICDU  Tasks 

A  small  subset  of  tasks  which  are  being  performed  either  just  before  or  during  the  occurrence 
of  an  incident  appear  repeatedly  in  the  ASRS  reports  reviewed.  This  suggests  that  some 
tasks  performed  by  means  of  the  FMC/CDU  may  be  more  difficult  than  others.  To  address 
this  possibility,  the  approximately  300  reports,  including  the  99  that  were  specifically  ana¬ 
lyzed  for  this  report,  were  reviewed  in  order  to  identify  these  complex  tasks.  Not  all  tasks 
are  equally  difficult  nor  does  task  difficulty  appear  to  be  simply  a  matter  of  the  number  of 
key  presses  involved.  Numerous  page  selections,  key  presses  made  in  conjunction  with  the 
mode  control  panel  in  order  to  couple  the  FMC  guidance  to  the  automation,  and  cognitive 
demands  for  determining  how  to  input  the  relevant  information  appear  to  affect  overall  task 
difficulty. 

Tasks  identified  as  potentially  more  complex  than  others  include: 

•  Developing  and  entering  a  crossing  restriction  at  a  distance  from  a  fix  along  a  radial 

•  Entering  a  route  not  in  the  flight  plan 

•  Cruise  to  climb  or  descent  clearances 

•  Direct  intercept  clearances 

•  Verification  of  planned  versus  “as-filed”  flight  plans/route  structures 

•  Intercepting  routes  away  from  VORs 

The  following  ASRS  reports  provide  examples  of  each  of  these  tasks,  and  serve  to  suggest 
the  complexities  involved  in  performing  that  task. 


Developing  and  Entering  a  Crossing  Restriction  at  a  Distance  From  a  Fix  Along  a  Radial 

(126707)  “Cleared  to  cross  80  miles  south  of  RIC  VOR  at  FL270.  We  were 
leveled  at  FL330.  The  aircraft  has  been  adapted  with  a  new  FMC.  This  particular 
restriction  was  difficult  to  get  accepted  into  the  FMC.  It  continuously  showed  down 
in  the  scratch  pad  (invalid  entry).  Nevertheless,  the  procedure  for  the  entry  was 
correct.  ATC  called  and  queried  us  about  it  and  we  initiated  the  descent  with  idle 
power  and  full  speed  brakes  and  330  knots.  ATC  asked  if  we  were  going  to  make  it. 
We  (I)  acknowledge  with  an  ‘affirmative’  and  continued  with  the  steep  descent.  As  I 
was  doing  so,  the  winds  were  showing  higher  than  usual  on  the  FMC  Progress  page. 
Upon  realizing  that  the  restriction  was  not  going  to  be  met,  just  when  we  were  going 
to  advise  ATC  and  request  vectors  so  as  to  meet  the  crossing  restriction,  DCA  ATC 
informed  us  not  to  make  a  steep  descent  because  there  was  no  conflicting  traffic 
involved.  I  understood  what  he  meant  by  that  statement  that  everything  was  okay  and 
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we  did  not  request  vectors,  but  continued  the  descent,  crossing  80  DME  about  1 ,000 
feet  high.” 

Entering  a  crossing  restriction  at  a  distance  from  a  fix  is  one  of  the  most  common  types  of 
clearances  received.  Nonetheless,  pilots  do  appear  to  have  trouble  implementing  this  clear¬ 
ance,  as  is  shown  in  this  example.  What  is  especially  interesting  about  the  example  is  the 
response  of  the  FMC  to  the  pilot’s  entered  data.  When  the  entered  data  do  not  meet  the 
requirements  of  the  FMC,  the  only  feedback  received  is  “Invalid  Entry.”  No  clues  are  pro¬ 
vided  as  to  the  nature  of  the  problem.  One  would  expect  that  this  lack  of  informative  feed¬ 
back  can  only  contribute  to  the  programmer’s  frustration.  This  example  also  demonstrates  a 
second  common  occurrence:  The  programmer’s  conviction  that  what  he/she  programmed  in 
was  correct.  This  conviction  is  common  to  many  of  the  ASRS  reports,  as  was  shown  in 
Table  4-1. 


Entering  a  Route  not  in  the  Flight  Plan 

(121873)  “We  were  approximately  100  miles  west  of  FNT  when  we  were  given  a 
descent  restriction  of  FL240,  65  miles  northwest  of  FNT.  FNT  was  not  on  our  route 
of  flight,  therefore,  in  order  to  enter  the  restriction  into  the  Legs  page  of  our  FMC  it 
was  necessary  to  build  it  into  our  route  at  the  appropriate  place.  The  FMC  will  not 
accept  65  northwest  of  FNT  because  of  other  points  along  our  route  between  FNT  and 
the  65  mile  point.  Therefore,  it  was  necessary  to  subtract  the  appropriate  a  mount  of 
distance  from  the  closest  point  to  the  east  of  the  65  mile  point.  I  accomplished  this 
and  made  the  restriction  as  requested.  Then  while  talking  to  DTW  approach  control, 
we  were  given  holding  instructions.  The  instructions  were  to  hold  northwest  of  the 
SVM  322/25  fix  right  turns,  10  mile  legs  at  FL200,  EFC  at  2010.  Again  SVM  was 
not  on  our  route.  Therefore,  it  had  to  be  programmed  into  the  Legs  page  of  the  FMC 
at  the  appropriate  point  then  the  holding  information  had  to  be  put  into  the  Holding 
page.  I  entered  the  information  correctly  except  that  I  entered  SVM  322  degrees 
radial  and  left  out  the  25  DME  fix.  I  backed  up  the  holding  fix  with  the  VOR  by 
manually  tuning  the  SVM  VOR  and  322  degree  radial  again  without  checking  the  25 
DME  fix.  While  we  were  doing  this  the  controller  changed  our  assigned  altitude 
approximately  five  times  to  eventually  12,999.  The  controller  was  very  busy  and 
called  us  XX 1234  instead  of  XX234.  There  was  another  aircraft  with  the  same 
numbers  as  the  first  two  digits  of  its  four  number  call  sign  and  it  appeared  he  was 
combining  our  call  sign  with  his.  While  I  was  off  the  ATC  frequency  talking  to  the 
company  about  our  delay,  ATC  called  and  told  us  we  were  past  our  holding  fix. 

Make  an  immediate  left  turn  and  level  at  13,000  feet.  We  accomplished  that,  as 
requested.  I  immediately  realized  my  mistake  and  began  to  rebuild  the  route  that  we 
were  originally  filed  (on  the  FMC)  and  establish  the  correct  holding  fix.  After  this 
was  accomplished  we  discovered  that  the  holding  fix  that  we  were  assigned  was  two 
miles  west  of  Pinto  intersection.  Pinto  was  on  our  original  route  of  flight.  DTW 
approach  controller  had  been  giving  other  aircraft  instructions  to  hold  at  Pinto.  My 
question  is  why  weren’t  we  given  the  same  instructions?  It  seems  unwise  to  give  us 
holding  instructions  off  of  a  navaid  that  wasn’t  on  our  route  of  flight  that  placed  us 
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two  miles  west  of  a  point  (Pinto)  that  was  on  our  route  of  flight.  While  everything 
that  was  given  to  us  was  legal,  I  believe  there  was  a  better  way  of  doing  it.  The  error 
was  mine,  however,  I  feel  that  controllers  need  to  understand  the  increase  in  workload 
that  is  placed  on  a  two-man  crew  using  an  FMC  when  given  restrictions  and  holding 
instructions  off  of  a  fix  not  on  their  route.  Not  to  mention  the  chance  of  error.  I 
understand  that  there  are  operational  requirements  to  do  this  from  time  to  time, 
however,  I  don’t  believe  this  was  the  case.  We  were  essentially  at  the  same  point  in 
the  sky  but  approach  controller  decided  to  define  it  with  a  navaid  not  on  our  route  as 
opposed  to  a  point  that  was.” 

Of  special  interest  in  this  example  is  the  reporter’s  description  of  the  CDU  pages  that  had  to 
be  accessed  in  order  to  program  the  clearance  into  the  FMC.  At  the  same  time,  the  pilot  must 
also  remember  what  the  clearance  was.  After  several  different  clearances  in  a  short  period  of 
time,  the  task  of  entering  clearances  into  the  FMC  and  remembering  the  correct  clearance  can 
become  problematic.  This  example  reinforces  the  impression  that  the  FMC  is  difficult  to  use 
when  quick  changes  to  the  flight  plan  are  required. 


Cruise  to  Climb  or  Descent  Clearances 

(116871)  “Enroute  from  ATL  to  CMH.  Given  late  handoff  to  Columbus  Ap¬ 
proach  from  Center.  Center  had  issued  a  vector  for  traffic.  Upon  contact  Columbus 
Approach  issued  crossing  restriction  of  1 1,000  feet  MSL  40  NM  south  of  Appleton 
Vortac.  The  aircraft  was  approximately  56  NM  southwest  of  Appleton  at  19,000 
MSL  at  300  KIAS.  The  crossing  restriction  included  an  airspeed  restriction  of  250 
KIAS  at  40  NM  south  of  Appleton.  Captain  attempted  to  program  the  FMS  to  com¬ 
ply  with  restriction  but  due  to  his  inexperience  with  the  aircraft  FMS  (two  months 
total  on  aircraft)  and  the  fact  that  the  aircraft  was  on  a  vector  that  had  taken  it  off  the 
FMS  L  NAV  course.  The  captain  could  not  properly  program  the  FMS  to  cause  the 
aircraft  to  leave  altitude.  Aircraft  was  taken  out  of  V  NAV  mode  and  flown  via 
vertical  speed  mode  by  first  officer  to  make  altitude  restriction.  Captain  informed 
Columbus  Approach  that  the  aircraft  would  be  unable  to  comply  with  speed  restric¬ 
tion  due  to  late  crossing  restriction  issuance.  Columbus  Approach  responded  by 
saying  that  they  needed  the  altitude  due  to  crossing  traffic  but  didn’t  clearly  indicate 
whether  or  not  the  speed  restriction  had  been  lifted.  Aircraft  was  above  descent 
profile  for  remainder  of  vectoring  for  ILS  10R  approach  due  to  speed  required  to 
make  crossing  restriction.  Compounding  the  problem  was  loss  of  communication 
with  Approach  due  to  a  stuck  mike  on  frequency.  Captain  switched  to  Columbus 
Tower  and  received  approach  and  landing  clearance.  Several  S-tums  were  required 
to  achieve  stabilized  approach  by  1000  feet  AGL.  Multiple  factors  of  unfamiliarity 
with  FMS  limitations,  late  crossing  restriction  by  Approach  and  fixation  on  FMS 
rather  than  using  DME  and  common  sense  resulted  in  a  hurried  confusing  situation. 
Better  FMS  training  with  emphasis  on  “Gotchas”  in  the  system  is  badly  needed.” 

There  is  little  to  add  about  the  problem  of  vertical  navigation.  Clearly,  altitude  deviations  are 

the  most  common  result  of  FMS-related  crew  error  and,  therefore,  require  additional  study. 
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Implementing  Direct  Intercept 

(114409)  “During  climbout  from  DFW  airport  on  aircraft  flight  XX  June/ 
Wednesday/89,  the  controller  issued  a  clearance  to  turn  to  a  heading  of  300  degrees  to 
intercept  the  DFW  274  degree  radial,  climb  to  and  maintain  16,000  feet,  and  maintain 
250  knots  until  advised.  As  the  first  officer  and  pilot  not  flying,  I  proceeded  to  read 
back  the  clearance  and  program  the  FMS  computer  for  route,  speed,  and  altitude.  The 
captain  selected  speed  intervention  of  250  knots  to  climb  to  the  assigned  altitude  of 
16,000  feet.  (16,000  feet  was  selected  in  the  altitude  window  correctly).  He  then 
monitored  for  traffic  and  my  programming  of  the  FMS.  Unfortunately,  the  autopilot 
entered  an  altitude  capture  mode  approaching  10,000  feet  instead  of  continuing  to 
climb  to  the  selected  16,000  feet.  In  addition,  the  auto  throttle  disregarded  the  250 
knot  speed  intervention  and  continued  to  accelerate.  The  controller  called  to  ask  our 
speed  and  as  I  looked  up  from  the  FMS  I  noticed  approximately  330  knots.  I  replied 
330  knots  slowing  to  250  knots  assigned.  It  should  be  noted  that  the  Climb  page  on 
the  FMS  was  programmed  for  V  NAV  operation  from  1000  feet  AGL  up  but  it  also 
malfunctioned  when  V  NAV  was  selected  at  1 ,000  feet.  At  the  time  of  the  incident, 
the  two  of  us  were  given  an  intercept  heading,  an  altitude  change,  and  a  speed  restric¬ 
tion.  In  the  process  of  attempting  to  accomplish  the  programming  of  the  FMS,  listen 
for  ATC  and  watch  for  traffic,  the  airspeed  capture  of  the  auto  throttles  was  over¬ 
looked  until  the  speed  approached  330  knots.  Callback  conversation  with  reporter 
revealed  the  following:  Reporter  states  that  he  had  programmed  the  FMS  for  depar¬ 
ture  but  was  at  the  time  very  busy  dealing  with  ATC  vectors  and  the  captain  had 
entered  the  speed  restriction  manually  into  the  FMS  but  the  system  ignored  the 
restriction  and  limitation  was  activated.  Many  things  were  taking  place  at  this  time 
and  it  was  difficult  for  the  reporter  to  say  for  sure  what  was  happening.  The  entire 
event  was  entered  into  the  maintenance  log  but  the  outcome  was  not  known  to  the 
reporter.  Supplemental  information  from  ACN  1 14194:  At  no  time  did  the  FMC  give 
a  warning  that  it  had  failed.” 

Direct  intercepts  are  of  special  interest  because  they  are  a  primary  means  for  accessing  the 
specific  route  of  interest.  There  are  two  common  scenarios  in  which  direct  intercepts  are 
used.  The  first,  described  in  the  example  above,  involves  transitioning  from  climbout  to  the 
first  leg  of  the  flight.  This  is  an  especially  busy  time  for  the  crew  in  that  the  aircraft  per¬ 
formance  parameters  are  constantly  changing  and  must  be  carefully  monitored. 

A  second  common  use  of  the  direct  intercept  involves  returning  to  the  flight  plan  pro¬ 
grammed  in  the  FMC.  In  this  case,  the  aircraft  has  been  diverted  (because  of  traffic,  weather, 
etc.)  away  from  the  programmed  plan.  If  the  crew  wants  to  return  to  the  FMC  flight  plan,  it 
is  not  simply  a  matter  of  pressing  the  L  NAV  switch  on  the  mode  control  panel.  For  ex¬ 
ample,  the  Boeing  767  requires  that  the  aircraft  be  within  2.5  miles  of  the  programmed 
course  in  order  for  L  NAV  to  be  engaged.  If  the  aircraft  is  outside  of  this  limit,  the  crew 
must  either  use  heading  select  to  guide  the  aircraft  to  the  course  or  enter  a  “Direct  To”  into 
the  FMC  flight  plan.  The  “Direct  To”  procedure  needs  to  be  investigated  in  some  detail  in 
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order  to  assess  its  ease  of  use  relative  to  the  other  demands  likely  to  be  imposed  on  the  crew 
when  attempting  to  implement  it. 


Verification  of  Planned  Versus  " As-filed ”  Flight  Plans! Route  Structures 

(86874)  “Crew  late  to  aircraft  due  to  changing  aircraft  in  PIT  and  on  other  side  of 
the  terminal.  Filed  flight  plan  was  different  than  programmed  company  route  in  the 
FMC.  Both  pilots  encountered  difficulty  in  entering  filed  route  into  FMC  prior  to 
pushback.  Finally  got  route  in  FMC  during  taxi-out.  After  airborne  and  at  FL370, 
center  clears  us  direct  to  Hancock.  Shortly  afterward,  cleared  us  to  FL290  when  40 
east  of  Hancock.  Last  I  knew,  FMC  was  flying  direct  to  Hancock  as  cleared.  Both 
heads  in  cockpit  trying  to  get  descent  information  into  the  FMC  when  I  look  up  and 
see  aircraft  has  turned  90  degrees  right  to  about  1 80  degrees  heading.  I  immediately 
switch  to  heading  mode  and  turn  back  to  the  east.  At  about  the  same  time.  New  York 
Center  calls  and  asks  where  we  are  going.  I  switch  to  manual  on  VOR  and  dial  in 
Hancock.  I  see  we  are  44  miles  southeast  of  Hancock  still  at  FL 370!  We  advise  ATC 
that  computer  must  have  had  a  ‘glitch’  in  it.  ATC  replies  that  they  get  glitches  all  the 
time  and  then  ATC  clears  us  direct  Bradley  and  begin  descent  to  FL290.  Ca^  tain  and 
I  discussed  what  happened  and  we  still  don’t  know!  ATC  had  no  further  comments 
and  no  mention  of  us  not  making  FL290  restriction.  Factors  affecting  problem: 
Rushing  to  get  aircraft  out  on  time.  Changing  stored  route  to  new  filed  route. 

Trouble  entering  descent  information/crossing  restriction  into  FMC.  Both  pilots 
relatively  new  to  aircraft  (four  months  each).  On  the  next  leg,  [controller]  gave  us  a 
new  route  from  PVD  to  DCA.  Again  we  had  trouble  entering  information.  Espe¬ 
cially  how  to  intercept  a  radial  off  of  a  ‘J’  airway.  I’m  going  back  to  the  ground 
instructors  and  ask  for  more  information.” 

Initial  entering  of  the  flight  plan  typically  takes  place  under  relatively  stress-free  conditions 
prior  to  leaving  the  gate.  It  is  not  unusual,  however,  for  the  flight  plan  to  be  modified  prior  to 
takeoff.  Under  these  conditions,  the  crew  is  busy  preparing  the  aircraft  for  takeoff  and  the 
accuracy  of  the  entered  plan  may  not  be  assessed.  As  this  report  suggests,  mistakes  in  modi¬ 
fying  the  flight  plan  while  on  the  ground  can  cause  serious  problems  when  in  the  air,  espe¬ 
cially  if  the  errors  affect  the  early  part  of  the  flight  when  the  crew  is  attempting  to  “clean  up” 
the  airplane. 


Intercepting  Routes  Away  from  VORs 

(107421)  “First  officer  was  flying  the  aircraft  from  TPA  to  MEM.  Departed  on 
runway  18R  and  in  departure  climb  first  officer  was  manually  flying  the  aircraft  using 
V  NAV  and  heading  functions  selected  on  the  flight  director.  Captain  was  perform¬ 
ing  the  pilot-not-flying  duties  or  copilot  duties.  Flight  XX  was  handed  off  to  JAX 
ATC  while  passing  10,000  feet  in  the  climb.  JAX  cleared  flight  XX  to  climb  to 
16,000  feet  and  fly  a  heading  of  360  degrees  to  intercept  the  349  degree  radial  of  PIE 
and  fly  this  radial  outbound.  Captain  set  the  PIE  frequency  and  349  degrees  on  the 
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flight  guidance  panel  and  then  selected  VOR  on  the  FMC  panel  to  have  a  course  bar 
on  the  HSI  display.  First  officer  adjusted  heading  to  fly  the  340  degree  radial  out¬ 
bound  as  the  course  bar  centered  on  the  HSI.  The  aircraft  is  now  out  of  1 2,000  feet 
and  climbing  at  4,000  feet  per  minute.  Flying  a  VOR  radial  is  not  usually  done  on 
this  large  transport  as  the  usual  procedure  is  point-to-point  L  NAV  for  course  naviga¬ 
tion.  First  officer  requested  a  PIE  349  degree/150  NM  fix  entered  on  the  FMC 
computer,  so  that  a  direct  course  could  be  flown.  This  took  two  settings  as  the  first 
direct  course  was  not  on  the  PIE  340  degree  radial.  Setting  this  direct  course  caused 
both  pilots  to  concentrate  on  course  and  not  watch  altitude  in  the  climb.  The  2,000 
feet  to  go  and  the  1,000  feet  to  go  call  outs  were  missed.  Captain  noticed  that  the 
altitude  was  15,800  feet  and  the  aircraft  was  still  climbing.  He  called  out  cleared  to 
16,000  feet  and  the  first  officer  stopped  the  climb  at  16,400  feet  and  descended  to 
16,000  feet.  JAX  called  flight  XX  assigned  altitude  is  16,000  feet  as  the  aircraft  was 
descending  to  16,000  feet.  Captain  reported  leveling  at  16,000  feet.  Contributing 
factors:  There  was  too  much  effort  on  flying  the  assigned  radial  and  not  enough 
concentration  on  the  altitude  during  the  climb.  The  events  described  above  took  less 
than  two  minutes.  First  officer  was  manually  flying  the  aircraft  which  takes  more 
concentration  on  course  and  altitude.  The  flight  director  does  not  have  a  VOR  func¬ 
tion.  This  increases  the  effort  to  fly  a  course.  Flying  a  VOR  radial  outbound  is  not  a 
common  procedure  for  line  flying  in  the  large  transport.  The  computer  only  allows 
flight  to  a  fix,  not  from  a  fix.  A  fix  must  be  established  on  the  outbound  radial  to  fly 
toward.  A  possible  preventive  action:  Fly  the  aircraft  using  VOR  displaced  on  the 
HSI  and  use  V  NAV  and  heading  on  the  flight  director.  Concentrate  on  course  and 
altitude  or  use  the  autopilot  to  fly  the  aircraft  using  V  NAV  and  heading  while  the  L 
NAV  fix  is  being  set  into  the  FMC.” 

If  task  difficulty  is  gauged  by  the  amount  of  heated  emotion  conveyed  by  the  reporter,  then 
the  task  of  intercepting  a  VOR  radial  and  flying  the  radial  from  the  VOR  is  clearly  one  of  the 
leaders  in  complexity.  Several  reports,  including  the  one  just  presented,  reflect  the  opinion 
that  the  crew  simply  should  never  be  given  this  type  of  clearance.  It  is  not  clear  as  to  just 
how  frequent  this  type  of  clearance  is  given,  but  the  complexity  that  is  apparently  involved  in 
figuring  out  how  to  set  up  the  FMS  to  fly  it  clearly  suggests  that  this  task  needs  to  be  investi¬ 
gated  in  greater  detail. 

Given  the  higher  than  normal  frequency  with  which  these  tasks  appear  in  the  ASRS  reports, 
there  may  be  some  value  in  analyzing  them  in  great  detail  in  order  to  ascertain  potential 
contributors  to  complexity,  such  as  possible  cognitive  difficulties  in  identifying  the  required 
data  to  be  entered  into  the  CDU,  problems  in  recognizing  whether  the  correct  information  has 
actually  been  entered,  and  workload  conflicts  between  performing  this  task  and  other  tasks 
that  need  to  be  accomplished  at  the  same  time.  These  types  of  analyses  could  also  suggest 
alternative  ways  for  performing  the  task  that  could  help  to  reduce  their  complexity. 

It  is,  of  course,  possible  (and  likely)  that  some  tasks  appear  frequently  in  the  ASRS  reports 
because  they  are  commonly  performed  tasks  and  therefore,  through  the  laws  of  chance,  more 
likely  to  be  the  task  being  performed  when  an  incident  occurs,  and  not  because  they  are  more 
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complex  than  other  tasks.  However,  since  they  are  common  tasks,  the  same  type  of  analysis 
would  also  be  appropriate  in  that  improvements  that  simplify  the  performance  of  commonly 
performed  tasks  could  contribute  to  better  use  of  the  FMS. 


4.12.8  Lack  of  Adequate  Pilot  Training 

The  review  of  the  ASRS  reports  used  in  this  study  raises  the  question  of  how  well  trained  are 
the  pilots  in  the  use  and  limitations  of  FMS,  in  particular  the  FMC/CDU.  Although  none  of 
the  reports  dealt  with  training  directly,  many  cited  training  as  a  factor  in  the  incident’s  occur¬ 
rence  (see  Table  4-2).  Many  of  these  pilots  reported  that  they  did  not  have  a  good  under¬ 
standing  the  of  underlying  logic  and  limitations  of  the  FMS,  and  seemed  to  become  easily 
confused  and  overloaded  in  high  workload  situations,  when  they  continued  to  try  and  pro¬ 
gram  the  FMS.  From  the  perspective  offered  by  these  reports,  it  appears  that  current  pilot 
training  does  not  accurately  reflect  real  world  needs  in  using  the  FMS  relative  to  ATC  re¬ 
quirements  and  the  resulting  high  workload.  The  following  report  addresses  this  issue. 

(116912)  “During  IOE  training  (enroute  PHL  to  CLE)  was  given  clearance  to 
cross  10  miles  east  of  YNG  Vortac  at  24,000  feet.  In  discussion  with  check  airman 
on  best  method  to  enter  this  information  into  the  FMC,  I  decided  to  start  down  and 
then  work  on  the  FMC  in  the  descent.  I  inadvertently  selected  10,000  feet  into  the 
flight  guidance  system.  Again,  we  went  heads  down  to  concentrate  on  the  pro¬ 
gramming  FMC  for  the  descent  path.  Moments  later,  CLE  center  requested  our 
altitude.  We  looked  up  as  we  were  through  22,000.  Leveled  out  at  21,000.  We 
informed  center.  Weather  was  clear  and  center  said  to  maintain  21,000.  Apparently, 
there  was  no  conflicting  traffic.  This  is  not  a  new  problem.  Automation  has  taken 
over  in  the  cockpit.  Computers  are  not  learned  overnight  and  (pilots)  need  hand  on 
operating  experience.  It  all  comes  back  to  fly  the  airplane  first.” 

While  this  particular  altitude  excursion  did  not  cause  a  serious  problem,  the  reporter’s  ob¬ 
servation  that  computers  are  not  learned  overnight  indicates  that  he  or  she  was  uncomfortable 
with  the  training  they  had  received.  Another  reporter  described  the  experience  this  way: 

(110413)  “This  was  my  first  trip  on  this  aircraft  without  training  people  on  board. 
This  is  still  a  brand  new  aircraft  and  none  of  the  pilots  have  much  exposure  or  ex¬ 
perience  flying  people  in  it.  We  were  on  the  Civet  profile  descent  to  runway  25L  at 
LAX.  Our  crossing  restriction  was  14,000  feet  to  Civet.  We  misinterpreted  our 
instruments  and  began  descent  to  10,000,  believing  we  were  inside  Civet.  At  about 
13,000  the  LAX  controller  told  us  we  had  started  down  early  and  needed  to  maintain 
14,000  to  Civet.  After  rechecking  our  instruments,  we  realized  that  our  DME  reading 
was  based  on  Fueler  intersection  instead  of  the  LAX  localizer  DME.  I  feel  this  was 
an  easy  mistake  to  make  based  on  our  limited  exposure  to  this  aircraft.  I  find  the 
glass  cockpit  a  very  difficult  system  to  master  and  a  frightfully  easy  way  to  make 
critical  mistakes — at  least  when  the  pilot  is  new  to  it...  A  fix  for  this  problem,  I 
believe,  is  more  training  for  the  crews.  Checkouts  have  become  extremely  costly 
forcing  airlines  to  make  them  in  the  shortest  time  possible,  which  is  understandable. 


4-23 


However,  I  think  more  training  would  help  pilots  with  this  extremely  complex  new 
flight  system.” 

The  reporter  was  contacted  by  ASRS  to  discuss  the  situation  further  and  the  reporter  offered 
the  following  observations. 

# 

(110413)  “The  flight  crew  was  very  low  on  combined  experience  as  the  Captain 
only  had  30  hours  of  experience  including  the  25  hours  of  IOE  time.  The  reporter 
stated  that  his  15  hours  he  had  as  operating  experience  was  three  take  offs  and  land¬ 
ings  and  the  rest  of  the  time  was  logged  from  the  jump  seat.  The  reporter  feels  this  is 
too  little  exposure  to  the  real  world  of  operating  a  $125  million  dollar  aircraft  and  that 
he  was  overworked  in  the  arrival  and  got  confused  as  the  Captain  started  the  descent 
prematurely.  He  was  of  no  assistance  in  preventing  the  deviation. . .  The  economics 
as  practiced  in  this  low  training  hours  approach  cannot  be  justified  considering  the 
possible  results  from  the  mix  of  low  in  type  pilots  in  an  ever  changing  and  ever 
increasing  complex  environment.  Providing  the  best  in  hands-on  experience  and 
training  should  be  the  goal  and. ..  first  officers  should  obtain  their  operating  experi¬ 
ence  in  the  seat  they  would  normally  function.  Jump  seat  riding  should  not  be  consid¬ 
ered  for  operating  experience  in  this  complex  aircraft.” 

The  training  these  pilots  received  seemed  to  focus  on  operating  the  system  without  consid¬ 
ering  the  difficulties  imposed  by  air  traffic  control  and  the  associated  workload.  This  is 
compounded  furthei  by  the  mixing  of  flight  crews  where  both  pilots  are  relatively  inexperi¬ 
enced.  This  was  an  often  cited  occurrence  in  these  reports. 

(124912)  “Finished  (aircraft)  checkout  on  6/89.  No  position  was  available  until 
10/89.  Flew  the  simulator  in  9/89  for  90-day  landing  currency.  You  could  say  the 
fine  points  of  working  the  FMC  has  escaped  my  memory.  We  were  cruising  at 
FL390  and  received  clearance  to  FL410.  Captain  loaded  in  mode  control  panel 
glareshield  altitude  at  which  point  asked  how  he  inputted  the  data  for  the  climb. 
Neither  of  us  were  monitoring  to  confirm  the  climb  to  FL410.  Several  minutes  later, 
center  asked  if  we  had  climbed.  “No,  still  at  290”.  The  altitude  had  not  been  put  in 
the  FMC,  and  we  were  navigating  with  V  NAV  and  L  NAV.  Both  crew  members 
low  experience  in  type  contributing  to  the  altitude  oversight.  Factors  affecting  perfor¬ 
mance:  1)  supervision  management  practice  of  putting  two  inexperienced  crew 
members  together;  2)  just  not  monitoring/keeping  track  of  crew’s  level  of  experience; 
and  3)  after  training  crew  member  on  advanced/automated  cockpit,  waiting  an  ex¬ 
tended  period  before  assignment  to  aircraft.  Fly  the  aircraft.” 

In  some  of  the  selected  ASRS  reports,  the  reporter  stated  that  the  training  on  the  FMS  was 
clearly  inadequate.  Other  reporters  cited  the  combination  of  being  new  to  the  airplane,  along 
with  less  than  adequate  training,  as  being  particularly  troublesome.  The  following  report  is 
descriptive  of  the  problem  of  pilots  being  relatively  new  to  the  airplane. 

(86894)  “After  (we  got)  airborne  and  at  FL370,  center  clears  us  to  FL290  when 
40  miles  (east)  of  Hancock.  Last  I  knew,  FMC  was  flying  direct  to  Hancock  as 
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cleared.  Roth  heads  (of  pilots)  in  cockpit  trying  to  get  descent  into  FMC  when  I  look 
up  and  see  aircraft  has  turned  90  degrees  right  to  about  a  180  heading...  I  switch  to 
manual  on  VOR  and  dial  in  Hancock.  I  see  we  are  44  miles  southeast  of  Hancock 
still  at  FL  370! . . .  Captain  and  I  discussed  what  happened  and  we  still  don’t  know. 
Factors  affecting  the  problem:  Rushing  to  get  aircraft  out  on  time,  changing  stored 
route  to  new  Filed  route,  trouble  entering  descent  info/crossing  restriction  into  the 
FMC,  and  both  pilots  relatively  new  to  the  aircraft  (4  months  each)...  I’m  going 
back  to  the  ground  instructors  and  ask  for  more  information.” 

Pilots  seem  to  be  concerned  with  the  fact  that  their  training  is  not  representative  of  how  the 
FMS  will  have  to  be  used  operationally.  The  constraints  of  traffic  congestion  and  multiple 
ATC  clearances  often  appeared  to  make  effective  use  of  the  FMS  difficult.  The  use  of  FMSs 
requires  a  somewhat  different  approach  to  flying  in  that  the  pilot  must  know  and  understand 
what  the  system  is  capable  of,  and  what  its  limitations  are  since  once  he  or  she  enters  a 
command,  the  FMS  will  theoretically  do  the  rest.  For  example,  one  limitation  may  be  that  it 
is  not  productive  to  try  and  use  the  full  capabilities  of  the  FMS  once  the  number  of  ATC 
instructions  start  to  increase  past  a  certain  level.  Other  limitations  may  be  due  to  the  V  NAV 
algorithms  themselves:  Since  they  were  designed  to  optimize  descent  and  climb  profiles  (in 
terms  of  being  cost  effective),  they  may  not  be  suitable  for  all  situations. 

When  a  pilot  is  flying  without  a  FMS,  they  are  more  likely  to  be  aware  that  they  are,  cr  are 
not,  meeting  an  ATC  restriction  or  clearance  since  they  are  constantly  managing  the  airplane 
to  meet  that  goal;  that  is  they  are  actively  “in  the  control  loop.”  The  FMS,  on  the  other  hand, 
strives  to  meet  that  goal  in  the  most  efficient  and  economical  manner  without  the  same  level 
of  pilot  involvement.  The  pilot’s  primary  interface  with  the  FMS  is  when  data  is  entered  or 
commands  issued.  In  this  situation  it  is  easy  for  the  pilots  to  rely  on  the  FMS  while  they  take 
care  of  other  duties,  but  it  is  clear  from  these  reports  that  use  of  the  FMS  does  not  appear  to 
be  suitable  for  every  activity  within  every  phase  of  flight.  The  training  need  for  pilots  would 
seem  to  be  centered  on  how  these  systems  should  best  be  used  under  the  operational  circum¬ 
stances  that  the  pilots  are  most  likely  to  encounter.  As  part  of  an  overall  training  approach, 
controllers  would  also  benefit  from  an  increased  awareness  of  the  capabilities  and  limitations 
of  FMS-equipped  airplanes. 

4.2  Hardware/Software-Related  Errors 

The  data  in  Table  4-4  summarize  the  findings  from  a  number  of  ASRS  reports  in  which  the 
flight  crew  believed  (stated)  that  the  FMS  itself  either  failed  or  had  a  design  flaw  which 
influenced  the  incident’s  occurrence.  Reported  system  perl  nnance  errors  involving  FMS 
hardware  were  usually  directly  related  to  the  failure  of  some  component  of  the  FMS.  System 
performance  errors  atributcd  to  software  mistakes  or  design  problems  were  more  difficult  to 
discover  but  usually  involved  reference  to  algorithms  that  either  did  not  work  as  intended  or 
were  judged  to  be  not  well  designed. 
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Table  4-4.  Hardware/Software-Related  Errors 


Category  Incident  Description  Citations 


3  System  performance  errors  (SPE)-attributed  to  hardware  15 

errors/failures. 

4  System  performance  errors  (SPE)-attributed  to  software  17 

mistakes/design  problems. 

10  Flight  management  system/mode  control  panel  3 

interaction  errors. 

11  Errors  related  to  pre-stored  databases/company  routes.  15 


Two  types  of  reported  errors  that  appear  to  create  the  greatest  difficulties  for  the  crew  are: 

•  FMC/MCP  interaction  errors  involving  commands  that  were  input  into  the  FMC  but 
were  not  properly  executed. 

•  Errors  relating  to  pre-stored  databases  that  involved  either  the  wrong  information,  or 
lack  of  specific  information,  being  in  the  database. 


4.2. 1  FMC/MCP  Interaction  Errors 

Several  of  the  reports  appear  to  indicate  that  the  FMS  can  be  programmed  correctly,  provide 
feedback  to  indicate  this,  yet  still  not  perform  as  intended.  In  the  example  below,  appropriate 
status  information  appeared  to  have  been  provided  (e.g.  top  of  descent  circle)  yet  the  FMS 
did  not  initiate  the  descent. 

(1 19740)  “On  August/Thursday/89, 1  was  the  captain  on  a  large  transport  aircraft 
flight  XX,  LGA-DTW.  Our  routing  was  the  LGA  3  SID  out  of  LGA  to  Neon  inter¬ 
section  J95  to  Kooper  direct  Aylmer  V-2  Rhyme  direct  DTW  airport.  We  were 
enroute  from  Kooper  to  Aylmer  at  FL350  and  were  cleared  to  cross  15  east  of  Aylmer 
at  FL310.  We  programmed  15  east  of  Aylmer  at  310  in  the  FMC  and  set  310  in  the 
mode  control  panel.  A  “top  of  descent”  circle  showed  up  on  the  screen  depicting 
where  the  descent  would  begin.  However,  at  the  top  of  descent  point,  the  aircraft  did 
not  descend  and  due  to  distracting  conversation  between  us,  neither  I  nor  the  first 
officer  noticed  it  until  we  were  about  20  miles  east  of  Aylmer.  I  immediately  started 
a  fairly  rapid  descent  of  about  4000  feet  per  minute  with  speed  brakes  and  saw  we 
were  not  going  to  make  15  east  Aylmer  at  FL310.  I  called  CLE  and  said  we  started 
down  too  late  and  were  not  going  to  make  15  east  Aylmer  at  310.  In  fact,  we  were 
crossing  15  east  Aylmer  at  330.  CLE  said  that’s  okay  and  gave  us  a  frequency 
change.  I  don’t  know  why,  with  everything  apparently  set  in  properly,  the  aircraft  did 
not  descend  at  the  proper  time.  I  feel  the  cause  of  this  mistake  is  too  much  reliance 
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on  automated  systems  and  a  lack  of  vigilance  on  my  part  as  to  the  altitude  and  posi¬ 
tion  of  my  aircraft.” 

If  this  is,  in  fact,  what  happened,  there  is  little  the  crew  can  do  to  prevent  the  occurrence  of 
an  incident  if  the  FMS  fails  to  “behave”  as  programmed.  By  the  time  the  crew  detects  a 
problem  (e.g.  failure  to  begin  a  descent  or  level  off),  it  may  be  too  late  to  compensate. 


4.2.2  Inaccurate  Pre-Stored  Databases 

A  number  of  reports  describe  errors  stemming  from  the  use  of  pre-stored  databases  that 
contained  incorrect  information.  Holding  patterns  and  crossing  fixes  based  on  DME  values 
often  were  depicted  differently  from  what  was  shown  on  the  charts  or  what  was  expected  by 
ATC.  For  example,  one  report  stated: 

(104874)  “(We  were)  Cleared  to  hold  at  Colax  intersection  on  the  Scurry  Arrival 
into  Dallas  Fort  Worth  (DFW).  (We)  Entered  the  hold  into  the  FMC/CDU.  The 
FMC/CDU  displayed  the  holding  pattern  automatically  and  (we)  entered  the  hold  as 
displayed.  However,  the  pattern  displayed  on  the  control  display  unit  (CDU)  was  for 
a  standard  hold  while  the  actual  pattern  at  Colax  is  a  non-standard  pattern  (left 
turns). . .  We  entered  holding  for  a  standard  pattern  rather  than  the  depicted  non 
standard  pattern. . .  It  was  a  mistake  that  was  prompted  probably  by  two  reasons:  1) 
believing  that  the  computer  generated  pattern  was  correct  and  2)  not  catching  the 
difference  when  checking  the  arrival  plate.” 

This  report  is  typical  of  the  types  of  reported  errors  relating  to  pre-programmed  navigational 
data  contained  in  the  FMS.  Incidents  related  to  pre-stored  navigation  routings  and  fixes  were 
associated  with  15%  of  the  99  reports.  These  types  of  errors  are  particularly  difficult  to 
recognize.  The  only  practical  way  for  a  pilot  to  discover  the  existence  of  this  type  of  fault, 
before  an  event  occurs,  is  to  compare  the  computer  generated  navigational  image  (on  both 
the  Navigation  Display  and  the  CDU)  against  the  information  contained  in  the  paper  naviga¬ 
tional  charts.  Once  the  problem  has  been  discovered,  the  flight  crew  often  still  had  difficulty 
responding  to  the  ATC  clearance  correctly  or  in  a  timely  manner  because  typically  they 
would  do  one  or  all  of  the  following: 

•  Try  to  find  the  fix  in  the  computer; 

•  Start  looking  for  the  fix  on  their  charts  once  they  discovered  that  it  was  not  in  the 
FMS  database,  or  was  wrong; 

•  Try  to  program  the  correct  information  into  the  FMC/CDU. 

Performing  these  additional  procedures  results  in  an  increase  in  the  pilot’s  workload  at  a  time 
when  workload  is  likely  to  be  already  increasing.  Some  pilots  also  pointed  out  that  the  need 
to  verify  every  fix  and  holding  pattern  eliminated  some  of  the  advantage  of  having  these  data 
stored  in  an  onboard  database. 

Coping  with  an  incorrect  or  missing  fix  or  holding  pattern  can  be  particularly  difficult  if  it 
occurs  during  a  high  workload  situation,  as  demonstrated  in  the  following  case  where  a 
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navigation  fix  being  used  as  a  holding  point  was  not  included  in  the  FMS  database. 

(117306)  “...Among  scattered  cumulus  and  thunderstorms,  on  autopilot,  FMS 
lateral  and  vertical  navigation  engaged,  and  level  at  1 1 ,000  feet. . .  Approach  control 
issued  us  holding  instructions  for  the  Krena  Intersection,  as  published,  1 1,000.  The 
Captain  requested  right  turns  in  the  pattern  due  to  a  thunderstorm  cell  and  the  request 
was  granted.  As  the  Captain  entering  the  hold  into  the  FMS,  the  aircraft  ahead  of  us 
requested  holding  at  Popps  Intersection  due  to  the  thunderstorm  at  Krena. . .  The 
controller  then  assigned  us  holding  at  Popps.  We  glanced  at  our  charts,  located 
Popps,  and  the  Captain  tried  to  enter  it  as  a  waypoint  in  the  FMS.  The  FMS  rejected 
it  as  not  in  the  database.  By  the  time  we  determined  the  distance  for  the  Northbrook 
VOR  to  Popps,  and  had  switched  to  VOR  mode,  we  were  two  to  three  miles  past 
Popps. . .  The  problem  arose  from,  I  feel,  three  factors;  1)  late  issuance  of  holding 
instructions  for  Popps,  2)  Popps  not  programmed  in  the  database  of  our  FMS,  and  3) 
our  dependence  on  FMS  navigation  and  slow  changeover  to  the  NAV-VOR  mode.” 

In  this  incident,  the  crew  reported  having  a  difficult  time  keeping  abreast  of  the  situation  due 
to  changing  weather  considerations,  other  traffic  entering  the  hold,  and  the  resulting  ATC 
instructions.  As  in  other  reports,  the  pilots  assumed  responsibility  for  the  incident  because 
they  felt  they  did  not  respond  quickly  enough  by  returning  to  basic  VOR  navigation  once 
they  were  aware  that  the  fix  was  not  in  the  computer. 

The  data  in  Table  4-5  provide  insight  as  to  where  the  pre-stored  database  routes  and  navi¬ 
gation  fixes  caused  problems  in  the  course  of  a  flight. 


Table  4-5.  Errors  Related  to  Pre-Stored  Databases/Company  Routes 


Phase  of  Flight 

Citations 

SID 

3 

Transition 

1 

Enroute 

4 

Crossing  Restrictions 

3 

Holding 

5 

Descent 

2 

STAR 

1 

Approach 

1 

Of  particular  interest  is  the  fact  that  five  of  the  six  holding  pattern  problems  included  in 
Table  4-3  (Phase  of  Flight)  were  caused  by  erroneous  information  being  stored  in  the  data¬ 
base.  As  pointed  out  earlier,  the  ATC  clearance  would  direct  the  flight  to  hold  at  a  fix  as 
depicted.  Based  on  the  ATC  clearance,  the  flight  crew  would  program  the  FMS/CDU  to  call 
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up  and  initiate  the  hold.  Subsequently,  ATC  would  then  inform  them  they  were  conducting 
the  hold  with  turns  opposite  that  charted.  The  main  concern  expressed  by  the  pilots  who 
experienced  the  problem  of  not  having  the  fix  correcdy  entered  into  the  pre-stored  database 
was  twofold: 

•  First,  they  typically  reported  that  they  found  themselves  surprised  and  had  to  rush  to 
find  the  appropriate  paper  charts  to  verify  where  they  should  be  going  or  what  fix 
they  should  be  using. 

•  Secondly,  this  problem,  once  experienced,  often  led  the  pilots  to  be  highly  skeptical 
of  the  comprehensiveness  of  the  FMS  database  and/or  the  systems  ability  to  readily 
access  these  data. 


4.2.3  Distribution  of  Incidents  Across  Aircraft  Type 

A  final  question  that  needs  to  be  addressed  concerns  the  issue  of  whether  one  type  of  aircraft/ 
FMS  configuration  is  responsible  for  the  majority  of  FMS-related  incidents.  A  good  deal  of 
discussion,  in  previous  ASRS  studies  and  other  sources,  has  been  devoted  to  the  problems 
with  altitude  busts  in  medium  large  transport  aircraft.  If  this  is  the  case,  the  conclusion  could 
be  made  that  FMS-related  problems  are  specific  to  that  aircraft/FMS  combination.  To 
evaluate  this  belief,  the  distribution  of  incidents  across  aircraft  type,  by  weight  class,  was 
compiled.  The  data  in  Table  4-6  show  the  results.  As  the  table  suggests,  there  appears  to  be 
an  even  distribution  of  incidents  between  the  MLG  and  the  LRG/WDB  classes  of  aircraft. 


Table  4-6.  Aircraft  Type 


Aircraft  Type 


Citations 


LTT  -  Light  Transport  Aircraft  (14.5  to  30  k.lbs.)  2 

MLG  -  Medium  Large  Transport  (60  -  150  k.lbs.)  50 

LRG  -  Large  Transport  Aircraft  (150  -  300  k.lbs.)  23 

WDB  -  Wide  Body  Transport.  24 


The  light  transport  airplanes  (LTT)  in  this  data  set  most  likely  represent  corporate  turbojet 
aircraft  with  advanced  automation  cockpit  features.  They  were  included  because  the  ad¬ 
vanced  automation  technology  features  are  not  limited  to  only  air  carrier  airplanes,  and  the 
reported  equipment  problems  are  similar  to  those  experienced  in  the  larger  commercial 
transport  aircraft.  Medium  large  transports  (MLG)  include  aircraft  such  as  DC-9/MD-80’s 
and  Boeing  737s.  The  large  transport  category  (LRG)  includes  aircraft  such  as  the  Boeing 
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757  and  the  Airbus  A-300,  while  the  wide  body  transport  (WDB)  category  includes  the 
Boeing  767,  Boeing  747,  and  Airbus  A-320. 

Table  4-7  shows  that  these  data  appear  to  indicate  that  the  problems  with  FMSs  are  generic  in 
terms  of  both  phase  of  flight  and  specific  FMS. 


Table  4-7.  Number  of  Citations  by  Aircraft  Type 


Aircraft  Activity 

Aircraft 

Climb 

Crossing 

Descent 

Type 

Restriction 

MLG 

10 

15 

7 

LRG/WDB 

11 

15 

7 
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5.  CONCLUSIONS 


While  the  sample  of  ASRS  reports,  reviewed  in  this  study,  cannot  be  said  to  be  statistically 
representative  of  all  FMS-related  incidents,  it  does  offer  a  useful  perspective  as  to  what  types 
of  problems  are  occurring  as  a  result  of  the  use  of  FMSs  in  the  National  Airspace  System. 
These  reports  provide  insight  into  problems  that  air  carrier  (and/or  corporate)  pilots  are 
having  with  FMSs  that  would  not  be  available  from  any  other  perspective  or  source.  The 
advantage  of  evaluating  ASRS  reports  such  as  these  is  that  the  insight  gained  can  be  used  to 
determine  where,  and  what  type  of,  operational  problems  exist  with  these  systems  “on  the 
line”  along  with  an  estimate  of  developing  trends. 

The  major  issues  associated  with  the  FMS-related  incidents,  addressed  in  this  analysis, 
include: 

•  Raw  Data  and  FMS/Aircraft  Status  Verification 

•  FMS  Algorithmic  “Behavior” 

•  Improper  Use  of  the  FMC  Automation  Level 

•  FMC  Programming  Demands 

•  Multiple  FMC  Page  Monitoring  Requirements 

•  Complex  ATC  Clearances 

•  Complex  FMC/CDU  Tasks 

•  Lack  of  Adequate  Pilot  Training 

•  FMC/MCP  Interaction  Errors 

•  Inaccurate  Pre-Stored  Databases 

All  of  these  factors,  singly  or  together,  can  combine  to  increase  the  pilots’  workload  to  the 
point  that  they  lose  their  situational  awareness  and  “get  behind  the  airplane.”  In  this  situa¬ 
tion,  the  pilot  who  continues  to  focus  on  trying  to  underhand  what  the  FMC/CDU  is  doing  is 
no  longer  truly  involved  in  flying  the  airplane,  but  trying  to  troubleshoot  a  computer  that 
happens  to  be  installed  in  an  airplane.  The  pilots  that  did  best  with  FMS-related  problems,  in 
high  workload  situations,  were  those  that  elected  to  reduce  the  level  of  automation  (by 
turning  OFF  the  selected  function)  and  appeared  to  recognize  that  they  needed  to  become 
actively  involved  in  flying  the  airplane. 

From  these  reports,  it  is  clear  that  the  current  FMSs  have  not  been  designed  for  optimal  use 
under  all  circumstances,  by  the  flight  crew,  in  the  environment  where  ATC  is  heavily  bur¬ 
dened  and  expects  pilots  to  remain  flexible  and  responsive  to  their  changing  needs  of  moving 
traffic.  Based  on  this  analysis,  it  would  appear  that  pilots  should  not  try  to  use  the  full 
features  of  the  FMS  under  all  conditions.  Many  of  the  pilots  submitting  these  reports  learned 
that  fact,  but  only  after  they  experienced  the  incident  that  initiated  the  ASRS  report.  This 
lends  credence  to  those  pilots  who  argued  that  the  training  they  received  was  not  adequate  to 
prepare  them  for  using  these  systems  operationally. 

Problems  attributed  to  the  FMS  design/user  interface  were  also  found  in  many  of  the  reports. 
The  most  commonly  reported  problem  area  was  the  vertical  navigation  capability  of  these 
systems.  The  algorithms  for  climb  and  descent  seem  to  be  predicated  on  the  most  efficient. 
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hence  most  rapid,  climb  to  and  descent  from  altitude.  Thus  it  would  appear  that  these 
algorithms  have  been  developed  in  such  a  manner  that  they  leave  little  margin  for  error  if  the 
system  does  not  initiate  actions  as  expected.  In  terms  of  utility,  it  might  be  wise  to  relax  the 
stringent  rules  and  criteria  that  were  used  for  developing  the  software  implemented  algo¬ 
rithms,  and  provide  a  wider  bandwidth  for  operational  application. 

Other  system/operational  related  problems  include  the  FMS  database  not  including  fixes  used 
by  ATC  or  having  the  wrong  fixes  or  flight  routings.  While  the  majority  of  these  deficien¬ 
cies  are  likely  to  be  identified  by  the  pilots  through  initial  checklists  and  verification  proce¬ 
dures,  the  difficulty  arises  when  ATC  changes  clearances  when  the  aircraft  is  in  the  air  and 
the  flight  crew  tries  to  enter  the  new  fix,  then  finds  that  it  is  not  in  the  database.  Many  times 
the  crew  will  continue  to  try  and  find  the  fix  in  the  database  rather  than  locate  the  fix  on  the 
charts.  This  wasted  valuable  time  which  sometimes  caused  the  clearance  to  not  be  achiev¬ 
able  by  the  flight  crew.  The  point  was  also  made  that  ATC  should  be  encouraged  to  use  fixes 
for  clearances  that  are  contained  within  the  FMS  database,  or  should  specify  fixes  along  the 
current  flight  path,  instead  of  fixes  that  have  already  been  passed  (and  therefore  dropped 
from  the  current  route/path). 

Recognition  and  understanding  of  the  nature  of  the  existing  problems,  such  as  those  identi¬ 
fied  and  described  in  this  report,  is  the  first  step  in  finding  solutions  and  making  recom¬ 
mendations  for  design  changes  that  will  make  FMSs  work  better,  and  be  less  prone  to  flight 
crew  error. 


5-2 


6.  RECOMMENDATIONS 


Two  types  of  recommendations  are  provided.  The  first  type  offers  suggestions  for  how  the 
results  of  this  study  should  be  used  to  guide  the  Description  and  Characterization  study  that 
is  currently  in  progress.  The  second  set  of  recommendations  are  more  global  in  nature, 
suggesting  changes  in  the  overall  FMS  “use  environment,”  including  suggested  additions  to 
crew  training  and  modifications  to  ATC  procedures. 

6. 1  Design-Related  Recommendations 

This  analysis  of  the  FMS-related  incident  reports  from  the  ASRS  database  has  provided  a 
valuable  look  at  the  problems  crews  are  having  with  current  FMSs.  On  the  basis  of  this 
review,  the  following  recommendations  suggest  how  the  Description  and  Characterization 
study  can  be  focused  to  concentrate  on  those  issues  that  appear  to  have  special  importance. 

1)  A  common  problem  involves  selection  of  the  appropriate  level  of  automation  to  be  used 
for  a  given  task.  As  Section  4. 1.2.3  clearly  points  out,  flight  crews  appear  reluctant  to 
use  a  mode  other  than  the  V  NAV  and  L  NAV  provided  by  the  FMC.  Consequently,  it 
would  be  of  value  to  analyze  the  FMS  as  a  system  which  is  comprised  of  multiple 
automation  levels  (flight  director,  autopilot,  FMC).  Each  of  these  levels  needs  to  be 
clearly  understood  in  terms  of  the  procedures  required  to  utilize  that  automation  level, 
steps  used  to  move  from  one  automation  level  to  another,  and  any  constraints  imposed 
by  one  automation  level  onto  another.  As  a  specific  example,  the  relationship  of  the 
autothrottle  to  vertical  and  lateral  path  control  needs  to  be  examined.  Several  reports 
suggested  that  the  crew  did  not  understand  the  logic  of  the  autothrottle  as  it  is  influ¬ 
enced  by  the  automation  levels  controlling  the  lateral  and  vertical  performance  modes. 

It  appears  that  many  flight  crew  simply  do  not  understand  how  the  various  subsystems 
contribute  to  the  overall  functioning  of  the  FMS. 

2)  As  a  supplement  to  the  first  recommendation,  a  task-oriented  analysis  should  be  per¬ 
formed  that  would  involve  identifying  alternative  ways  of  performing  the  same  task, 
and  the  conditions  under  which  each  alternative  is  preferred.  Many  of  the  incidents  in 
the  ASRS  reports  occurred  because  the  crew  chose  a  poor  alternative  over  one  that 
would  have  been  more  effective.  This  analysis  might  aid  in  understanding  the  decision 
making  process  that  must  be  performed  in  order  to  correctly  choose  how  to  perform  a 
given  task. 

3)  Feedback  sources  for  each  automation  level,  and  for  each  task,  need  to  be  specified.  A 
major  concern  for  many  flight  crews  is  the  inability  to  effectively  predict  and  un¬ 
derstand  what  the  FMS  is  doing.  Issues  of  adequate  and  meaningful  feedback  need  to 
be  addressed. 

4)  As  a  supplement  to  the  third  recommendation,  the  role  of  the  algorithms  as  they  affect 
the  “behavior”  of  the  aircraft  also  needs  to  be  examined.  A  number  of  problems  with 
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vertical  navigation  appear  to  be  the  result  of  the  crew’s  inability  to  adequately  take  into 
account  the  temporal  contributions  of  the  algorithms  in  predicting  the  short-term  and 
long-term  responses  of  the  aircraft. 

5)  Section  4. 1 .2.7  argued  that  some  tasks  appear  to  be  more  difficult  to  perform  than 
others.  An  analysis  of  the  procedures  required  to  perform  these  apparently  complex 
tasks  may  enable  a  better  understanding  of  the  sources  of  the  complexity  to  be 
achieved.  The  vast  literature  on  user-computer  interaction  should  be  applied  to  the 
FMC/CDU  in  order  to  determine  what  elements  of  screen  design  and  system  logic 
appear  to  be  problematic. 

6)  The  number  of  screens  that  have  to  be  reviewed  in  performing  some  tasks  also  is  an 
important  issue.  There  is  an  obvious  need  to  review  the  overall  organization  and  layout 
of  information  across  pages,  and  the  means  for  navigating  from  one  screen  to  another, 
in  order  to  determine  the  contributions  of  these  factors  to  the  complexity  of  the  task. 

7)  The  evaluation  of  feedback  sources  needs  to  be  addressed  within  the  context  of  prob¬ 
lems  that  can  arise  as  a  result  of  incorrect  or  missing  data  in  the  database.  Clearly,  the 
obvious  solution  to  this  problem  is  to  ensure  that  all  of  the  data  is  there  and  that  it  is 
correct.  This,  however,  may  not  be  a  totally  achievable  solution.  Consequently,  the 
question  arises  as  to  how  the  crew  can  be  helped  to  more  quickly  recognize  the  exist¬ 
ence  of  the  problem  in  order  to  give  them  additional  time  to  cope. 

8)  Finally,  a  tool  (or  tools)  that  would  allow  an  overall  assessment  of  how  easy  a  specific 
FMS  is  to  use  would  have  great  value,  especially  as  a  means  for  evaluating  new  FMSs 
when  they  are  presented  for  certification.  This  recommendation  may  be  an  ideal  that  is 
not  achievable  at  this  time  but,  at  the  very  least,  attempts  to  develop  such  a  tool  that 
would  support  the  identification  of  factors  that  contribute  to  complexity.  This  second¬ 
ary  goal  would  support  attempts  to  design  FMSs  that  are  easier  to  use  on  the  basis  of 
established  principles  that  define  complexity  and  the  conditions  that  contribute  to  it. 

6.2  Global  Recommendations 

1)  Training  of  pilots  flying  FMS-equipped  airplanes  needs  to  be  representative  of  the 
problems  that  are  likely  to  be  encountered  operationally,  especially  those  actions  and 
activities  related  to  working  with  AT C.  This  might  include  such  approaches  as  numer¬ 
ous  LOFT  scenarios  based  on  real  world  clearances  and  problems  that  impact  FMS 
utilization,  programming/re-programming,  automation  management  and  overall  situa¬ 
tion  awareness,  as  part  of  the  overall  training  curriculum. 

The  need  for  this  intensive  training  could  potentially  be  reduced  by  re-design  of  the 
FMC/CDU  mode/screen  logic  to  incorporate  a  better  human-computer  interface.  This 
could  be  possible  through  the  use  of  prompts  that  “lead”  the  pilot  through  the  sequential 
steps  necessary  to  program  or  implement  the  desired  clearance  or  action. 
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2)  Based  on  the  pilots’  comments  in  the  ASRS  reports,  it  would  appear  that  it  is  not  a 
good  practice  to  assign  two  pilots  with  low  experience  in  FMS-equipped  airplanes  to 
the  same  flight  crew.  Because  of  the  complexities  associated  with  using  the  current 
FMSs,  experience  (in  terms  of  hands-on  operational  use)  with  the  FMS  appears  to  be 
the  best  measure  of  how  well  the  flight  crew  can  use  the  FMS  to  accomplish  the  as¬ 
signed  tasks. 

3)  The  current  V  NAV  climb/descent  algorithms  need  to  be  re-programmed  to  “soften” 
the  climb  or  descent  during  the  last  1 ,000  feet.  These  algorithmic  changes  will  give  the 
pilots  a  little  more  flexibility  in  recognizing  potential  problems  without  compromising 
the  efficiency  (i.e.,  cost)  of  the  flight  to  a  great  degree.  Changes  in  the  way  that  the 
algorithms  are  structured  and  the  way  that  they  are  executed  should  also  eliminate  the 
need  to  use  excessive  vertical  speed  to  accomplish  the  climb  or  descent. 

4)  The  operational  demands  (from  both  cognitive  and  visual  workload  perspectives)  on  the 
two-pilot  crew,  both  in  the  enroute  environment  and  the  high  workload  terminal  envi¬ 
ronment,  need  to  be  considered  in  the  design  and  certification  of  FMSs.  This  is  espe¬ 
cially  necessary  with  regard  to  the  user  interface  (in  terms  of  screen  layout  and  naviga¬ 
tion),  the  automation  selection  algorithms,  and  the  placement  of  the  feedback  informa¬ 
tion.  The  location  and  manner  of  presentation  of  critical  information  is  an  important 
design  issue  that  needs  to  be  looked  at.  This  will  determine  the  appropriate  place  to  put 
pilot  feedback  information  with  respect  to  the  mode  that  the  aircraft/FMS  is  actually  in 
at  any  point. 

5)  There  is  a  need  to  investigate  the  feasibility  of  providing  a  “preferred  fix”  list  to  the 
ATC  facilities.  This  list  would  be  provided  by  the  same  commercial  firms  that  cur¬ 
rently  provide  the  database  and  database  updates  for  the  air  carriers’  FMSs.  The  re¬ 
sultant  improvement  in  the  flight  crews’  ability  to  program/re-program  the  FMS  to 
accomplish  the  requested  clearance  based  on  the  use  of  common  well-defined  fixes  will 
positively  impact  the  efficiency  of  ATC  operations  involving  FMS-equipped  airplanes. 

7)  The  Enroute/Terminal  air  traffic  controllers  should  receive  some  training  on  the 
strengths  and  limitations  of  FMS-equipped  airplanes.  How  best  to  plan  for  these  consid¬ 
erations  when  controlling  FMS-equipped  aircraft  in  their  airspace  should  also  be 
stressed. 

8)  The  feasibility  of  improving  the  error  checking/notification  logic  of  the  FMS  should  be 
evaluated.  One  particular  concern  is  the  pilot’s  ability  to  make  erroneous  fix  entries 
which  are  accepted  simply  because  they  are  contained  in  the  database,  but  are  not  valid 
for  that  particular  flight. 

There  is  little  question  that  the  inclusion  of  FMS  technology  in  modem  air  carrier  aircraft  has 

been  extremely  advantageous  and  has  provided  improvements  in  both  efficiency  and  safety 

of  operation.  However,  since  the  FMS  design-related  issues  raised  in  this  report  are  consid- 
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ered  representative  of  the  types  of  problems  that  currently  exist,  it  is  important  that  a  thor¬ 
ough  description/characterization  analysis  of  the  existing  FMSs  be  performed.  This  will 
ensure  that  the  potential  user  interface  and  logic  problems  that  appear  to  exist  in  the  current 
systems  are  understood.  Furthermore,  it  is  recognized  that  some  of  the  potential  sources  of 
pilot  error,  in  the  newer  systems,  are  difficult  to  recognize  until  a  significant  amount  of 
experience  has  been  gained  in  the  use  of  the  FMS  technology.  For  example,  as  of  this  report, 
there  are  only  a  few  entries  in  the  ASRS  database  concerning  the  use  of  the  highly  controlled, 
highly  automated  Flight  Management  Guidance  System  on  the  A320  aircraft.  It  is  assumed 
that  as  more  experience  is  gained  with  the  A320  FMGS  system  in  the  NAS,  there  will  be  an 
increased  number  of  reported  issues  and  incidents  in  the  ASRS  database.  For  these  reasons, 
the  ASRS  database,  as  well  as  other  sources,  should  be  reviewed  periodically  in  order  to 
identify  trends  in  FMS-related  incidents.  For  example,  there  appear  to  be  well  over  200 
entries  in  this  category  for  the  year,  1990,  as  compared  to  approximately  170  reports  for 
1989. 

The  primary  goal  should  be  the  continued  improvement  of  FMSs  in  such  a  manner  that  the 
flight  crews  should  not  have  to  interpret  “what”  the  system  is  going  to  do,  or  “how”  to 
implement  a  specific  time-critical,  short-term  task.  Instead,  the  FMS  should  be  designed  so 
that  programming  logics  and  procedures  are  easy  to  implement  and  appropriate  feedback  is 
available  to  keep  the  pilot/flight  crew  constantly  aware  of  what  the  system  is  doing. 
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